Message has ambiguous content

[j123m]

Guten Abend!

Wir haben ein Problem mit einer eingehenden Mail, die eigentlich vom Aufbau her in Ordnung ist, das smtp-filter aber einen "fast exit" macht.

Mar 18 17:44:03 svmhpmg1 pmg-smtp-filter[29170]: 2026/03/18-17:44:03 CONNECT TCP Peer: "[127.0.0.1]:58294" Local: "[127.0.0.1]:10024"
Mar 18 17:44:03 svmhpmg1 pmg-smtp-filter[29170]: 611AB69BAD65372286: message has ambiguous content
Mar 18 17:44:03 svmhpmg1 pmg-smtp-filter[29170]: fast exit because of errors (free 272613376 bytes)

Kann man das Logging anpassen, damit man mehr Informationen zum Grund bekommen könnte.

Für Hinweise wäre ich sehr dankbar.

 

[YaZoal]

Seems related to Subject: PSA-2026-00005-1: Bypass of mail filters through confusion of the MIME Parser [0]
For testing purposes, try to enable `accept-broken-mime` [0] and then try sending the email again.If the emails are accepted afterward, the problem most likely lies in the structure of the message generated by the sending system.

[0] https://forum.proxmox.com/threads/proxmox-mail-gateway-security-advisories.149333/post-838667
[1] https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_mailproxy_options

 

[j123m]

Thank you for your explanation. The behavior is exactly as described.
So the solution is to keep the accept_broken_mime setting.

 

[YaZoal]

Thanks for the updates.
Basically, The PMG now strictly rejects mails with broken or ambiguous MIME structure [0].
For security reasons its advised to create rules to better handle this cases instead of generally accepting mails with ambiguous/broken mime structure.
For this you should be able to make use of the added header after enabling accept-broken-mime. As explained in the documentation [1] :

accept-broken-mime: <boolean> (default = 0)
Accept e-mails with broken MIME structure (insecure). If enabled, a X-Proxmox-Broken-Message header is added to each mail with broken MIME structure.

The rules can be as below:

1. a Who rule[2] matching your sender and another What Object Match field matching X-Proxmox-Broken-Message (with any content - i.e. '.*' ), action Accept.
2. Another rule with lower priority with the same What Object for X-Proxmox-Broken-Message and action Block.

[0] https://forum.proxmox.com/threads/proxmox-mail-gateway-security-advisories.149333/post-838667
[1] https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_mailproxy_options
[2] https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#chapter_mailfilter

 

[j123m]

We identified the root cause of the issue.
The affected email contains a malformed MIME part with a duplicated header:

Content-Disposition: inline
Content-Disposition: inline


This leads to “message has ambiguous content” in pmg-smtp-filter and causes the message to be rejected.
After removing the duplicate header, the message is processed correctly.

This is not conform, but anyway other mailgateways seem to accept this.
Does anyone have an opinion on this?