The vulnerability in bc-csharp before 2.7.0 stems from improper handling of trailing dots in RFC 1034 fully qualified domain names during PKIX certification path validation. Specifically, the PkixNameConstraintValidator does not remove the trailing dot from rfc822Name, dNSName, or uniformResourceIdentifier names before comparing them against excluded subtrees defined by a name-constrained intermediate CA. This allows certificates with names ending in a dot to be accepted even if they should be excluded, potentially enabling an attacker with control over such a CA to issue certificates that bypass intended name constraints.

An attacker who controls or can obtain certificates from a name-constrained intermediate CA can have certificates accepted during PKIX certification path validation for names that should be excluded by name constraints. This undermines the trust model of certificate validation for email addresses, DNS names, and URI hosts, potentially allowing unauthorized certificates to be trusted.

A fix is available in bc-csharp version 2.7.0. Users should upgrade to version 2.7.0 or later to remediate this vulnerability. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes.