CVE-2026-59638

A flaw was found in Bouncy Castle for Java. The Java Secure Socket Extension (JSSE) hostname verifier incorrectly enables the Common Name (CN) fallback by default, despite it being documented as an opt-in feature. This misconfiguration could allow a remote attacker to bypass proper hostname validation by presenting a specially crafted certificate during a TLS (Transport Layer Security) handshake. As a result, an attacker might be able to impersonate a legitimate server, leading to potential man-in-the-middle attacks and information disclosure.

A flaw was found in Bouncy Castle for Java's JSSE provider (bctls). The hostname verifier improperly enables Common Name (CN) fallback by default during TLS certificate validation, contrary to documented opt-in requirements. A remote attacker capable of intercepting TLS traffic could exploit this by presenting a specially crafted certificate with a matching CN, bypassing hostname verification. This allows the attacker to impersonate a trusted server, leading to potential Man-in-the-Middle (MitM) attacks and exposure of sensitive encrypted data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.