LoginSign Up
← Back to all sparks
R

Rspamd

COMMS
Velocity5.0

Fast spam filtering system for mail servers

rspamd.com ↗

Rspamd 4.2 hardens its parsers and ships memory-safety fixes three releases running.

spam filteringinput hardeningattachment extractionhtml parsingmemory safetydeprecation path
◆Current state
The 4.2 line opened in September with a public suffix lookup replacing the old TLD tables, attachment content extraction for SVG, OOXML and DOCX, and one scheduler over the symbol dependency graph. 4.2.1 fixed critical memory-safety bugs including an HTTP heap overflow. 4.2.2 added wallet-address detection across twelve named currencies and changed MIME digests. 4.2.3 stopped trusting ARC forwarders whose seal fails and merged duplicate RBL queries, so a rule scores once per matched value.
◆Where it's heading
The input-hardening walk from 4.1.x has become line-wide policy: limits on untrusted UCL, bounded PDF and decompression work, and HTML parsing that matches browsers so content cannot hide from the scan. Detection moves the same way, into what attachments and hidden text actually contain. Point releases keep carrying incompatible changes to digests and scoring, so operators need to read the notes on every update.
◆Prediction
Expect more browser-parity fixes in HTML and URL handling, and attachment extraction beyond the SVG and OOXML set. The planned flip of allow_file_and_shm_inputs to false does not appear in the 4.2 notes, so it remains the breaking change to watch.

◆Recent moves

  1. 15d ago

    4.2.3: ARC trust fix, merged RBL queries, browser-style HTML parsing

    Fixes a real trust gap, where a whitelisted forwarder with a broken ARC seal could still lower DMARC, and brings HTML parsing closer to browsers. RBL scoring also changes, so a rule now counts once per matched value.

    View source ↗
  2. 25d ago

    4.2.2: crypto wallet detection and changed MIME digests

    Wallet-address detection replaces bitcoin.lua and extends to twelve named currencies with one symbol each. The MIME digest change is the upgrade risk, since anything keyed on old digests stops matching.

    View source ↗
  3. 1mo ago

    4.2.1: critical HTTP and memory-safety fixes

    A security release flagged as strongly recommended: an HTTP heap overflow, a use-after-free and a cryptobox change that now fails closed. It extends the 4.1.x audit into the new line.

    View source ↗
  4. 1mo ago

    4.2.0: public suffix lookup and attachment content extraction

    The largest release in this window, with a public suffix component, attachment extraction and a single symbol scheduler. It adds detection depth while carrying the hostile-input work forward.

    View source ↗
  5. 2mo ago

    Closes an arbitrary file read reachable by any TCP client

    Continues the input-hardening pass that has run through every 4.1.x release, this time gating File, Path and Shm message sources behind a flag that defaults on now and off in the next major — a deliberate deprecation path rather than a silent break. The fuzzy subsystem gains sender authentication facts shared with storages, and the PDF parser learns font-aware decoding, both extending components rebuilt earlier in the cycle.

    View source ↗
  6. 3mo ago

    Controller accepted any password on a malformed hash

    A critical authentication fix — the controller failed open on a malformed password hash — alongside regexp engine bounds and a jemalloc linking change that stops startup segfaults. Part of the same walk through input paths that 4.1.5 continues.

    View source ↗