Repository navigation
Security: postalsys/mailauth
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
-
dkim: verifying a message with many DKIM-Signature fields takes quadratic timeGHSA-ccrc-5r42-qv47 published
Oct 19, 2026 by andris9Moderate -
received: with trustReceived, a HELO containing '(x [ip]) by' sets the client IP used for SPFGHSA-22rq-g766-4fv5 published
Oct 19, 2026 by andris9High -
bimi: indicator and evidence downloads follow redirects to http:, have no size limit and accept localhost or IP literal hostsGHSA-xgcx-4gmm-4g3v published
Oct 19, 2026 by andris9High -
bimi: validateBimiSvg() accepts event handlers, prefixed <script>, foreignObject and external referencesGHSA-p63r-4j88-mrg3 published
Oct 19, 2026 by andris9Moderate -
bimi: validateVMC() builds a BIMI-Indicator header from an unvalidated l= download when there is no a=GHSA-jm34-3v73-589c published
Oct 19, 2026 by andris9Moderate -
spf: MAIL FROM or HELO domain with a trailing dot gives "none" without any DNS lookupGHSA-cq6q-5v46-4v67 published
Oct 19, 2026 by andris9Moderate -
dkim: d= with '/', '?' or '#' is reported as aligned with a different From domainGHSA-vwxq-x7fc-65mv published
Oct 19, 2026 by andris9High -
dmarc: Author Domain with invisible or control characters is evaluated instead of rejectedGHSA-mfpx-vqr9-4hf6 published
Oct 19, 2026 by andris9Moderate -
dmarc: From header parsed with addressparser yields a truncated or wrong Author DomainGHSA-7f3j-9r7x-fq3j published
Oct 19, 2026 by andris9High
Learn more about advisories related to postalsys/mailauth in the GitHub Advisory Database