CVE-2026-103602 describes an improper certificate validation vulnerability in the PkixNameConstraintValidator of Legion of the Bouncy Castle Inc. bc-csharp prior to version 2.7.0. The vulnerability occurs because the validation logic does not remove the RFC 1034 root-label trailing dot when comparing names and constraints. As a result, certificates issued by a name-constrained intermediate CA can be accepted for email addresses, DNS names, or URI hosts that should be excluded by the name constraints if the host name ends with a dot. This allows an attacker controlling or able to obtain certificates from such a CA to bypass intended restrictions during PKIX certification path validation.

An attacker who controls or can obtain certificates from a name-constrained intermediate CA can have certificates accepted for names that should be excluded by the name constraints. This undermines the trust model of PKIX certification path validation for email addresses, DNS names, or URI hosts, potentially allowing unauthorized certificates to be trusted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a fix is available, users should be cautious when trusting certificates from name-constrained intermediate CAs and monitor vendor communications for updates.