Openarc
Monthly
A NULL pointer dereference in the Trusted Domain Project's OpenARC ARC milter (affected versions up to and including 1.0.0.Beta1) allows a remote, unauthenticated sender to crash the milter by delivering an email whose ARC canonicalization (c=) tag causes arc_parse_canon_t in libopenarc/arc-canon.c to dereference a NULL pointer. Publicly available exploit code exists, but the impact is confined to availability - the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reported CVSS 4.0 vector both carry no confidentiality or integrity consequence, so this is a pure denial-of-service condition, not code execution or data exposure. Exploitation requires that OpenARC be deployed inbound on a Postfix or Sendmail MTA and actively performing ARC validation on received mail, which limits real-world exposure given the product's beta-stage, optional mail-authentication footprint.
A NULL pointer dereference in the Trusted Domain Project's OpenARC ARC milter (affected versions up to and including 1.0.0.Beta1) allows a remote, unauthenticated sender to crash the milter by delivering an email whose ARC canonicalization (c=) tag causes arc_parse_canon_t in libopenarc/arc-canon.c to dereference a NULL pointer. Publicly available exploit code exists, but the impact is confined to availability - the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reported CVSS 4.0 vector both carry no confidentiality or integrity consequence, so this is a pure denial-of-service condition, not code execution or data exposure. Exploitation requires that OpenARC be deployed inbound on a Postfix or Sendmail MTA and actively performing ARC validation on received mail, which limits real-world exposure given the product's beta-stage, optional mail-authentication footprint.