Rspamd Files

Incompatible changes

• Build: rspamd now links a single shared jemalloc instance per process and refuses a static-only jemalloc — duplicated allocators caused segfaults at startup

Features

• WebUI: read-only users can now access the Selectors tab and the Errors history

Bug fixes

• Controller (critical): fail closed on a malformed password hash — previously any password was accepted
• Regexp engine: fix a PCRE2 match-data leak on invalid UTF input, bound the heap a single match can use, stop re:matchn() looping forever on empty matches, avoid reading past the end of a bounded pattern when generating ids, and propagate the regexp data limit to named scopes
• Message processing: consult the Lua URL filter at most twice per user field instead of once per byte, and bound the words retained per message with a message-wide budget
• CSS: skip comments iteratively in the tokeniser, avoiding a stack overflow on many sequential comments
• Startup: release actrie GLib allocations with g_free, fixing a startup segfault with jemalloc
• rspamadm: resolve SRV-based upstreams and wait for storages in fuzzy_ping and fuzzy_hash

Full changelog: https://github.com/rspamd/rspamd/compare/4.1.3...4.1.4