Data Loss Prevention (DLP) Sensor Worker Hang on Nested Base64 Attachments
Processing inbound or outbound SMTP emails containing recursive multipart MIME Base64 streams drives scanunitd DLP workers into unescapable infinite loops, pinning CPU cores at 100% and completely halting enterprise mail delivery.
Technical Root Cause Analysis
FortiOS Data Loss Prevention relies on the scanunitd daemon and the dlp_engine library to unpack, decode, and parse file attachments transmitted across inspected protocols (SMTP, SMTPS, POP3, IMAP, and HTTP POST). When inspecting email messages, the decoder parses MIME boundary headers, unwraps Base64 transport encoding, and submits plaintext payloads to regex and fingerprint sensors.
In FortiOS 7.2.2 through 7.2.6, the Base64 stream unpacker lacked an upper bound on nested boundary recursions and lacked circular reference validation. When processing malformed emails—such as automated ticketing system notifications with nested forwarded attachments or deliberately crafted nested MIME parts—the unpacker entered an infinite loop re-evaluating the same boundary offset without advancing stream pointers. A single hung email pinned a scanunitd worker core at 100% CPU. Because FortiGate operates a finite pool of scanner workers, subsequent incoming emails were queued behind hung workers until the entire pool became exhausted, causing inbound and outbound SMTP connections to time out and paralyzing mail transfer agents (MTAs).
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.2 – 7.2.6 | 7.2.7+ | Cap archive depth / Recycle workers |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Upgraded recursion guard integrated |
| FortiOS 7.0 | 7.0.6 – 7.0.12 | 7.0.13+ | Bypass DLP on trusted MTA trunks |
Platform Impact: Enterprise firewalls (FG-200F through FG-3000F) inspecting high-volume corporate email relays or secure email gateway (SEG) edge policies with DLP enabled.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these commands to confirm whether scanunitd processes are locked at 100% CPU and query the DLP engine worker queue:
Diagnostic Commands
# 1. Inspect real-time CPU consumption across scanunitd worker daemons
diagnose sys top 2 5 | grep scanunit
# 2. View active scanner unit queues, pending jobs, and worker thread states
diagnose test application scanunit 2
# 3. Check memory footprint of scanning daemons
diagnose sys top-mem 10
# 4. View active DLP profile and sensor bindings on SMTP policies
show dlp sensor
show firewall profile-protocol-optionsRemediation & Workaround Steps (Teaser Preview)
Immediately unfreeze hung scanner workers and restore uninterrupted corporate mail flow:
Frequently Asked Questions
FortiOS allocates a fixed pool of scanunitd scanner worker processes based on CPU core count. When an email with circular or deeply nested Base64 MIME boundaries is processed, a worker enters an infinite decoding loop. Successive emails route into remaining workers until all threads are stuck at 100% CPU, creating total SMTP backpressure.
While most frequently triggered by multipart MIME emails on port 25/465/587, the same scanunitd DLP engine inspects HTTP POST file uploads if a DLP sensor is attached to web proxy policies, potentially affecting file transfers.
Fortinet resolved this flaw in FortiOS 7.2.7 and 7.4.2 by introducing strict recursion depth limits (maximum 16 nested layers) and circular MIME boundary validation in the dlp_engine decoder.