CVE-2026-82520 Details
Description
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.
A denial-of-service vulnerability has been identified in Parsedmarc versions prior to 11.0.1. The issue arises because the application decompresses gzip and ZIP attachments from DMARC report emails in a single, unbounded read, without any limit on the size of the decompressed output. This flaw allows an unauthenticated remote attacker to send a crafted email with a highly compressed attachment, causing the Parsedmarc process to allocate memory based on the uncompressed size. As a result, available RAM is exhausted, leading to a crash of the Parsedmarc worker or the host.
Users are advised to update to Parsedmarc version 11.0.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/domainaware/parsedmarc/security/advisories/GHSA-43qf-f35w-2x4r | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/domainaware/parsedmarc/releases/tag/11.0.1 | [email protected] | Release NotesVendor |
| https://github.com/domainaware/parsedmarc/security/advisories/GHSA-43qf-f35w-2x4r | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/parsedmarc-zip-bomb-dos-via-compressed-email-attachments | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parsedmarc | < 11.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |