]> dgit.raspbian.org Git - dovecot.git/commit
[PATCH 2/3] lib-storage: thread - Limit References: header msgid count to prevent...
authorTimo Sirainen <timo.sirainen@open-xchange.com>
Thu, 16 Apr 2026 16:26:47 +0000 (16:26 +0000)
committerNoah Meyerhans <noahm@debian.org>
Wed, 16 Sep 2026 19:06:35 +0000 (15:06 -0400)
commit1a7e39480245e75587e85b02c083f83275cc9929
tree993d272716920177443d4c8854612fc3c8358f00
parentdf1017145e4be4479514e5e4ea6251c2bf5fa21e
[PATCH 2/3] lib-storage: thread - Limit References: header msgid count to prevent O(N^2) CPU usage

Cap per-message References ingestion at MAIL_THREAD_REFERENCES_MAX (1000)
in mail_thread_map_add_mail(). Without this limit a single crafted email
with N unique Message-IDs triggers N(N-1)/2 ancestor traversals in
thread_node_has_ancestor(), allowing unauthenticated DoS via mail delivery.

Gbp-Pq: Name 0002-lib-storage-thread-Limit-References-header-msgid-cou.patch
src/lib-storage/index/index-thread-private.h
src/lib-storage/index/index-thread.c