rspamd 4.1.2 fixes remote DoS in the MIME parser

Deeply nested message/rfc822 messages could take down the scanner — 4.1.2 bounds the recursion depth. The release also corrects DMARC and SPF address evaluation and changes glob map matching.

The rspamd project has released version 4.1.2. Two of the fixes are flagged as security-relevant: the MIME parser now bounds the recursion depth for nested message/rfc822 parts — previously, a sufficiently deeply nested message could trigger a remote DoS. In addition, secretbox encryption and decryption now passes the properly padded nonce; short nonces previously caused an out-of-bounds read.

This affects every rspamd installation — including setups where rspamd runs as part of a stack such as mailcow. The DoS flaw carries the most weight because the MIME parser processes every incoming message: an attacker only needs to deliver a crafted email, with no authentication and no special network position required.

The release also corrects sender-identity evaluation: the aliases rule no longer rewrites From address domains (googlemail.com is no longer normalized to gmail.com), and DMARC, SPF and forged_recipients now evaluate addresses as they appear in the message — not after alias rewriting. Individual symbol results and scores may shift as a consequence.

One behavior change can affect existing configurations: glob patterns in maps now match anchored against the whole value under test. Entries that relied on substring matching need explicit wildcards as of 4.1.2.

If you run rspamd, update to 4.1.2 promptly, review map entries that use glob patterns afterwards, and keep an eye on scores over the first days in case the changed address evaluation weights individual rules differently.