AIKIDO-2026-467986
bctls-jdk18on is vulnerable to Improper Certificate Validation
78
High Risk
This Affects:
bctls-jdk18onTL;DR
The Bouncy Castle JSSE provider's HTTPS endpoint identification falls back to matching a server certificate's subject common name when the certificate carries no SubjectAltName dNSName entry. This CN fallback is active by default even though it is documented as opt-in, so an unrelated or mis-issued certificate that names the host only in its common name can satisfy hostname verification. A certificate presented over the network can therefore defeat the client's server-identity check and allow the TLS connection to be intercepted. The fix disables the CN fallback by default and gates it behind a dedicated system property.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses the Bouncy Castle JSSE provider (BCJSSE) as a TLS client that relies on HTTPS hostname verification to authenticate servers.
Background info
bctls-jdk18on is vulnerable to Improper Certificate Validation in versions 1.61.0 - 1.84.0.
How to fix this
Upgrade the org.bouncycastle:bctls-jdk18on library to the patch version.
Links
Fix Commits
github.com/bcgit/bc-java/commit/5ac55351cd1a8a7184d41c96a7ee87df0770240agithub.com/bcgit/bc-java/commit/799bd15320a6310a447863638aa3df64acef829b
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant