rspamd 4.1.4 fixes critical authentication bypass in the controller

A malformed password hash in the rspamd controller accepted any password — 4.1.4 closes the gap. Also fixed: regexp memory leaks, a CSS tokeniser stack overflow, and a startup segfault.

The rspamd project has released version 4.1.4. The most serious fix is flagged critical in the controller: if the stored password hash was malformed, rspamd accepted any password. This affects the WebUI and every other access path that authenticates through the controller — an attacker only needed network access to the controller port.

Beyond that, 4.1.4 fixes several memory safety and stability issues in the regexp engine: a PCRE2 match-data leak on invalid UTF input, unbounded heap usage from a single match, an infinite loop in re:matchn() on empty matches, and a read past the end of a bounded pattern during ID generation. In the CSS tokeniser, many sequential comments caused a stack overflow — the tokeniser now processes them iteratively instead of recursively.

A separate startup fix affects installations using jemalloc: GLib allocations in the actrie module were previously freed with the wrong deallocator, which could segfault at startup. Additionally, rspamd 4.1.4 now always links a single shared jemalloc instance per process and refuses a static-only variant that previously caused segfaults as well.

Anyone running rspamd should update to 4.1.4 promptly — the authentication bypass affects every installation with an active controller, whether rspamd runs standalone or as part of a stack such as mailcow.