This vulnerability in Legion of the Bouncy Castle Inc.'s BC-JAVA library involves the JSSE hostname verifier's CN-fallback feature being enabled by default, contrary to documentation that it should be opt-in. This improper validation of certificates with host mismatches (CWE-297) can lead to security issues in TLS connections. Affected versions include all releases before 1.85, LTS versions before 2.73.12, and FIPS versions before bctls-fips 1.0.24, 2.0.24, and 2.1.24. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, but high impact on confidentiality and integrity.

The vulnerability allows improper validation of TLS certificates due to the hostname verifier CN-fallback being enabled by default. This can potentially allow attackers to bypass hostname verification, undermining the trust model of TLS connections and exposing applications using affected Bouncy Castle Java versions to man-in-the-middle or impersonation attacks. The critical CVSS score reflects the high risk of confidentiality and integrity compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the vendor's announcements for updates and consider disabling CN-fallback hostname verification if possible as a temporary mitigation until an official fix is released.