This vulnerability (CWE-297) in Bouncy Castle for Java involves improper validation of certificates due to the JSSE hostname verifier CN-fallback being enabled by default. This behavior contradicts the documented requirement for explicit opt-in, potentially allowing hostname mismatches to go unchecked during TLS certificate validation. Affected versions include BC-JAVA before 1.85, BC-JAVA LTS before 2.73.12, and BC-JAVA FIPS versions prior to specified patch versions in the 1.0.X, 2.0.X, and 2.1.X series. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

The vulnerability allows an attacker to exploit improper certificate validation, specifically hostname mismatches, which can undermine the security of TLS connections. This can lead to man-in-the-middle attacks where an attacker intercepts or alters communications without detection. The critical CVSS score reflects the high risk of remote exploitation without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's announcements for updates. Until a patch is available, consider disabling the CN-fallback feature if possible or implementing additional hostname verification controls outside of the vulnerable library behavior.