CVE-2026-63576 describes an improper certificate validation vulnerability in the PkixNameConstraintValidator (ExtractHostFromURL) function of Legion of the Bouncy Castle Inc. bc-csharp versions prior to 2.7.0. The vulnerability allows bypassing permitted or excluded uniformResourceIdentifier name constraints during certification path validation. This occurs because the host extraction logic uses string slicing without isolating the authority component as defined in RFC 3986, leading to incorrect host comparisons when the URI's path, query, fragment, or userinfo contain characters such as '@' or ':'. This flaw can be exploited by a name-constrained subordinate CA or anyone able to obtain certificates with chosen subjectAltName URIs from such a CA.

The vulnerability enables bypassing of URI name constraints during certificate path validation, potentially allowing unauthorized certificates to be accepted as valid. This undermines the trust model of certificate validation and could lead to acceptance of malicious or unauthorized certificates. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor for vendor updates and apply patches once available. Until then, cautious use of affected versions is advised.