—score not recorded
Ambiguous multi-at-sign mailbox evades excluded email name constraints
Fixed in: Java 1.85 and C# 2.7.0, with default strict email-name parsing
fixed publicly
details
- Finding IDs
- F-BC-NC-MULTIAT-001
- Status
- fixed publicly
- Fixed in
- Java 1.85 and C# 2.7.0, with default strict email-name parsing
- Recorded credit
- 1seal (Oleh Konko), acknowledged in Bouncy Castle CONTRIBUTORS.md for rfc822Name name-constraint hardening
- Note
- A certificate email name with an at-sign inside a quoted local part could be split at the first at-sign, causing an excluded-domain check to miss the actual mailbox domain. Java commit a535c770 on 2 July 2026 and C# commit 9c2f6510 on 6 July reject ambiguous multiple-at-sign tested names when email constraints apply; regression tests include the reported quoted-local-part form. Both Java 1.85 and C# 2.7.0 contain the check. The optional lenient-rfc822-name compatibility setting restores the old parsing, so the fixed-version statement assumes the default strict configuration. Bouncy Castle credits 1seal for X.509 rfc822Name name-constraint security analysis and classifies this report as hardening, without a CVE. This is separate from trailing-dot normalization; no severity or fresh end-to-end retest is inferred.
F-BC-NC-MULTIAT-001: Verification failures. Splitting a quoted mailbox at the first at-sign compares the wrong domain against certificate name constraints. Reviewed 26 Sep 2026. Mechanism assessed by 1seal.
Mechanism source for F-BC-NC-MULTIAT-001
Security area (1seal assessment): Identity. Splitting a quoted mailbox at the first at-sign compares the wrong domain against certificate name constraints. Reviewed 26 Sep 2026.