Ambiguous multi-at-sign mailbox evades excluded email name constraints

Finding IDs

F-BC-NC-MULTIAT-001

Status

fixed publicly

Fixed in

Java 1.85 and C# 2.7.0, with default strict email-name parsing

Note

A certificate email name with an at-sign inside a quoted local part could be split at the first at-sign, causing an excluded-domain check to miss the actual mailbox domain. Java commit a535c770 on 2 July 2026 and C# commit 9c2f6510 on 6 July reject ambiguous multiple-at-sign tested names when email constraints apply; regression tests include the reported quoted-local-part form. Both Java 1.85 and C# 2.7.0 contain the check. The optional lenient-rfc822-name compatibility setting restores the old parsing, so the fixed-version statement assumes the default strict configuration. This is separate from trailing-dot DNS normalization; no CVE is inferred from adjacent name-constraint fixes. Public-source review does not establish vendor attribution, an assigned severity or a fresh end-to-end retest.

F-BC-NC-MULTIAT-001: Verification failures. Splitting a quoted mailbox at the first at-sign compares the wrong domain against certificate name constraints. Reviewed 26 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-BC-NC-MULTIAT-001

Security area (1seal assessment): Identity. Splitting a quoted mailbox at the first at-sign compares the wrong domain against certificate name constraints. Reviewed 26 Sep 2026.

• Source: github.com (external) ↗
• F-BC-NC-MULTIAT-001
• C# ambiguity rejection and regression tests
• Java 1.85: constrained email checks
• C# 2.7.0: strict check and compatibility switch
• Classification source