The vulnerability in Bouncy Castle for Java prior to version 1.86 (including LTS before 2.73.13 and FIPS versions before bcpkix-fips 1.0.13, 2.0.13, and 2.1.13) involves the PKIXCertPathReviewer class failing to apply X.509 name constraints to the end-entity certificate. The checkNameConstraints method did not evaluate the leaf certificate's subject DN or subjectAltName against permitted and excluded subtrees, allowing a certificate chain with a leaf violating its CA's name constraints to be incorrectly validated as valid by the reviewer. This discrepancy between the reviewer and the CertPathValidator could lead applications relying solely on the reviewer for trust decisions to accept unauthorized certificates. The fix ensures all certificates in the path, including the leaf, are checked according to RFC 5280 requirements.

Applications using the vulnerable PKIXCertPathReviewer for trust decisions could accept certificate chains with leaf certificates that violate name constraints imposed by their issuing CA. This undermines the trust model and could allow unauthorized certificates to be accepted, potentially enabling man-in-the-middle or impersonation attacks if exploited. However, the standard CertPathValidator implementation was not affected and would reject such chains, limiting the impact to applications relying solely on the flawed reviewer.

A fix is available in Bouncy Castle for Java version 1.86 and later, as well as in LTS versions 2.73.13 and later, and FIPS versions bcpkix-fips 1.0.13, 2.0.13, and 2.1.13 and later. Users should upgrade to these fixed versions to ensure proper enforcement of X.509 name constraints on end-entity certificates. No additional mitigation is required if using CertPathValidator or updated versions.