Rspamd 4.3 spam filter fixes crash vulnerabilities, hardens phishing and email authentication

Rspamd 4.3, the open-source spam filtering system for email servers, addresses several security flaws that could cause worker processes to crash or stop accepting connections, including malformed HTTP headers, empty Deliver-To values, and use-after-free bugs in Milter sessions. The release also corrects HTTP connection pooling behavior that previously ignored TLS verification settings and destination addresses when reusing connections.

Beyond security fixes, Rspamd 4.3 introduces substantial improvements to phishing detection, email authentication protocols, and content inspection. URL display-destination mismatches are now scored separately from general phishing detection, with new trust maps for legitimate link-rewriting services. SPF evaluation now preserves record order, DKIM verification rejects weak RSA keys under 1024 bits and duplicate signatures, and ARC verification applies stricter trust rules. Attachment scanning better handles archive filename obfuscation, while HTML parsing improvements and a new tiny pixel tracker rule address modern evasion techniques.

Security and authentication hardening in Rspamd 4.3

• Worker crash vulnerabilities: Fixes malformed HTTP header parsing, empty Deliver-To values, and use-after-free issues in Milter sessions that could terminate worker processes or halt connection acceptance.
• HTTP connection pool security: Corrects pooled connection reuse to properly account for TLS verification settings and destination addresses, and adds protections against requests to local and special-purpose network addresses.
• Phishing detection architecture: Separates URL display-destination mismatch scoring from general phishing detection, introduces trust maps for permitted link-rewriting services, and maintains conservative default scoring to limit false positives.
• Email authentication strictness: SPF records evaluate in original order; DKIM rejects duplicate signature tags, invalid key types, and RSA keys shorter than 1024 bits; ARC verification tightens restrictions on trusted forwarded authentication results.
• Content inspection improvements: Archive scanning handles alternative filenames correctly, filename checks detect trailing spaces and dots disguising extensions, HTML parsing resists CSS-based evasion, and a new HTML_TINY_PIXEL_TRACKER rule flags tracking pixel probes.

Why it matters

For Linux mail server administrators and distributions packaging Rspamd, this release closes exploitable denial-of-service vectors and reduces the attack surface for phishing campaigns that rely on authentication protocol weaknesses or archive filename obfuscation. The stricter validation rules and changed symbol formatting may require updates to existing custom filtering configurations, particularly for organizations with complex SPF, DKIM, or ARC deployments.