rspamd 4.1.3 fixes out-of-bounds read in DKIM signature verification

An unbounded bh= length in DKIM signatures allowed an out-of-bounds read during ed25519 verification — 4.1.3 bounds it. Three more memory-safety bugs are also flagged critical.

The rspamd project has released version 4.1.3. Four of the fixes are explicitly flagged as critical. The most serious is in DKIM verification: the length of the bh= tag in a DKIM signature was not bounded before the body hash comparison, which could cause an out-of-bounds read during ed25519 signature verification. Because rspamd checks every incoming message that carries a DKIM signature, a single crafted mail is enough to trigger it — no other precondition required.

The three remaining critical fixes address internal memory handling: a fuzzy TCP session could release its owner more than once, causing a use-after-free on aborted connections; bounds validation for shared-memory segments in the internal protocol previously accepted non-regular segments outside the expected limits; and the shared HTTP body storage lifecycle had a double free, a leaked file descriptor 0, and could close an unrelated socket.

4.1.3 also ships two incompatible changes: the WebUI drops jQuery and Font Awesome entirely in favor of native DOM and a local SVG sprite, and HAVE_ED25519 now only scopes OpenSSL key parsing, so ed25519 verification works on OpenSSL builds without that flag.

Anyone running rspamd should update to 4.1.3 promptly — the DKIM issue affects every installation that verifies incoming signatures, whether rspamd runs standalone or as part of a stack such as mailcow.