{
  "title": "ARC chain result published before all seal verifications complete",
  "category": "bugs",
  "type": "logic-bug",
  "severity": "low",
  "cvss": null,
  "ecosystem": "c",
  "project": {
    "owner": "rspamd",
    "repo": "rspamd",
    "url": "https://github.com/rspamd/rspamd"
  },
  "affected_versions": null,
  "status": "fixed",
  "disclosure": {
    "channel": "public-issue",
    "ghsa_id": null,
    "cve_id": null,
    "url": "https://github.com/rspamd/rspamd/issues/6310",
    "reported_at": "2026-10-13T16:53:01+03:00",
    "published_at": "2026-10-13T16:53:01+03:00"
  },
  "summary": "Public issue opened by the maintainer and labelled as a bug, crediting ucsurf for the original report. ARC verification could publish ARC_ALLOW and cache arc-allow before every ARC-Seal check had finished, so a seal that failed later left the allow result in place. Fixed by the maintainer in PR #6311 (https://github.com/rspamd/rspamd/pull/6311, merged 2026-10-14T10:18:20+03:00), which publishes the chain result only after all seal checks complete. Tracked as a bug, not a security advisory.",
  "discovered_at": "2026-10-11T00:00:00+03:00",
  "public": true,
  "credit": "ucsurf",
  "updated_at": "2026-10-14T10:26:00+03:00",
  "id": "bugs/c/rspamd__rspamd/2026-10-14-arc-seal-wait-for-all-checks"
}