Vulnerability analysis · DKIM verification

A message that starts with a space or a tab makes dkimpy index an empty list in rfc822_parse(), raising an IndexError that no caller is told to catch [dkimpy ≤ 1.1.8, latest release checked 2026-07-30]

Yongzhe Xu, Virginia Tech  ·  yongzhe@vt.edu  ·  2026-07-31

1. Overview

A header line that begins with whitespace is a continuation of the header above it. rfc822_parse() handles one by appending it to the previous header, with headers[-1][1] += .... If the whitespace line is the first line of the message, there is no header above it. headers is still an empty list, and indexing it with -1 raises IndexError.

Nothing catches that exception and nothing converts it to the library's own DKIMException. It travels out of DKIM.verify() to the caller. The documented contract tells callers to catch DKIMException, so an application that followed the documentation does not catch this one and dies.

2. Analysis

The input does not have to be a valid message, a signed message, or even a plausible one. The first byte decides. A leading space or tab is read as a folding continuation of a header that was never parsed, and the empty-list index follows immediately.

>>> import dkim
>>> dkim.DKIM(b" \r\n").verify(dnsfunc=lambda n, **k: b"")
Traceback (most recent call last):
  ...
  File ".../dkim/__init__.py", line 372, in rfc822_parse
    headers[-1][1] += line
IndexError: list index out of range

3. Reproduction

1. Install dkimpy 1.1.8.
2. Run either call below. The DNS callback returns an empty answer, so no key lookup is

involved; the parser fails before that point.

import dkim

dkim.DKIM(b" \r\n").verify(dnsfunc=lambda n, **k: b"")   # IndexError
dkim.DKIM(b"\tx\r\n").verify(dnsfunc=lambda n, **k: b"")  # IndexError

Expected: a malformed message is rejected through the library's documented error type, DKIMException or a subclass of it.

Observed: IndexError: list index out of range from rfc822_parse() at dkim/__init__.py line 372.

Two bytes are enough. Space and tab both do it.

4. Assessment

Exposed is any application that hands untrusted message bytes to dkim.DKIM() or dkim.verify() and catches only DKIMException, which is what the documentation instructs. The attacker needs to deliver one message whose first byte is a space. No authentication, no valid signature, no knowledge of the target's configuration.

The result in a mail filter is a processing failure on that message. In a single-threaded filter it is a service outage. How bad it gets depends on how the calling application handles an unexpected exception, which this report does not attempt to enumerate.

Reach extends past direct users of the library. authheaders depends on dkimpy, and so do several Python mail filters.

5. Remediation

Treat a continuation line that has no header above it as a malformed message. Do not index an empty list.

if line[0] in b' \t':
    if not headers:
        raise MessageFormatError("continuation line before any header")
    headers[-1][1] += line

Raising the library's own exception type keeps the documented contract intact. If bug-compatibility with permissive parsers matters more, drop the stray line silently instead.

6. References

• RFC 5322 section 2.2.3 - long header fields and folding
• CWE-248: Uncaught Exception
• dkimpy on PyPI