Sisimai: Mail Analyzing Interface

Release Notes

Sisimai 5.7.2

2026/08/31

Sisimai 5.7.2 has been released. The main changes in this release are fixes for a ReDoS vulnerability in the Perl and Ruby versions, alongside bug fixes in the Go version. Changes in the Perl version of Sisimai are indicated by Perl at the beginning of each item, changes in the Ruby version of Sisimai are indicated by Ruby, and changes in the Go version of Sisimai are indicated by Go.

And then, Sisimai 5 includes many changes that are not compatible with Version 4, so please check the Perl or Ruby version of your environment before installing or upgrading.

Fixes for ReDoS vulnerability

  • Perl Ruby Fixed a vulnerability where processing a bounce mail with a specially crafted HTML part through the to_plain method of Sisimai::String resulted in significantly increased processing time and 100% CPU utilization. This vulnerability affects all Sisimai versions 5.7.1 and earlier. The Go version of Sisimai is not affected by this vulnerability as it does not use regular expressions for this process.

Bug Fixes

  • Go Fixed a bug where Message-ID: and Subject: header values from the original email in a bounce message were mistakenly converted to lowercase. #443 #444 #445

Code Improvements and environments

  • Ruby Fixed an issue where the tidy method in Sisimai::Message consumed excessive memory while processing bounce emails. #455
  • Perl Sisimai works on Perl 5.44. #683
  • Go Sisimai can be built with Go 1.27. #441