CSeverity: LowStatus: Fixed

ARC chain result published before all seal verifications complete

Public issue opened by the maintainer and labelled as a bug, crediting ucsurf for the original report. ARC verification could publish ARC_ALLOW and cache arc-allow before every ARC-Seal check had finished, so a seal that failed later left the allow result in place. Fixed by the maintainer in PR #6311 (https://github.com/rspamd/rspamd/pull/6311, merged 2026-10-14T10:18:20+03:00), which publishes the chain result only after all seal checks complete. Tracked as a bug, not a security advisory.

Timeline

11 October 2026 Found
13 October 2026 Reported via public issue
13 October 2026 Disclosed publicly
14 October 2026 Entry last updated

Machine-readable: JSON · Markdown · ID bugs/c/rspamd__rspamd/2026-10-14-arc-seal-wait-for-all-checks