CVE-2026-82520— parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments
Quick assessment
Affected
domainaware parsedmarc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
parsedmarc 11.0.1 版本之前，在解压缩 gzip 和 ZIP 附件时，会执行一次无上限的读取操作，且对解压缩后的输出大小没有设置限制。由于 parsedmarc 会自动处理接收到的 DMARC 报告邮件，且无需用户交互，因此未经认证的远程攻击者可以向被监控的邮箱发送一封经过精心构造的邮件，其中包含高压缩比的附件。这将导致 parsedmarc 进程按照解压缩后的数据大小分配内存，从而耗尽可用 RAM，引发内存耗尽问题。
Possible ATT&CK Techniques 1 AI
T1487
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82520
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments
Source: CVE Program / CVE List V5
Vulnerability Description
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| domainaware | parsedmarc | 0 ~ 11.0.1 | - |
|
II. Public POCs for CVE-2026-82520
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82520
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-82520 (2)
Vendor Pages for CVE-2026-82520 (1)
IV. Related Vulnerabilities
Same weakness: CWE-409
-
CVE-2026-84382
HTTPX2: Streaming response decompression does not bound peak -
CVE-2026-78594
Improper Handling of Highly Compressed Data in APM Server Le -
CVE-2026-72628
Improper Handling of Highly Compressed Data in Kibana Leadin -
CVE-2026-82864
pdfme pdf-lib before 5.5.10 Denial of Service via Decompress -
CVE-2026-58107
Authenticated Remote Denial of Service via Unbounded zlib De
V. Comments for CVE-2026-82520
No comments yet