Description

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T21:17:22.407Z",
  "pubdate": "2026-09-03T21:17:22.407Z",
  "executiveSummary": "The parsedmarc software, prior to version 11.0.1, is vulnerable to an uncontrolled resource consumption vulnerability stemming from insecure handling of compressed email attachments.\nThe vulnerability is categorized as a Denial of Service (DoS) risk caused by unbounded memory allocation during the decompression of GZIP and ZIP archives.\nBecause parsedmarc is designed to automatically ingest and process DMARC report emails, the system remains in a constant state of listener-based operation, which exposes it to unauthenticated remote attackers.\nBy delivering a specially crafted email containing highly compressed data (a 'decompression bomb'), an attacker can trigger an excessive memory allocation request that forces the application to consume system RAM proportional to the uncompressed payload size.\nThe successful exploitation of this vulnerability results in memory exhaustion, leading to process crashes or system-wide instability, effectively halting the DMARC report processing pipeline.\nNo user interaction is required for this attack, making it highly impactful for organizations that rely on parsedmarc for automated email authentication monitoring.\nThe primary risk implication is the compromise of availability and the potential disruption of security observability pipelines.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the attachment extraction logic within parsedmarc, which performs decompression of GZIP and ZIP files using an unbounded read operation.\nIn the vulnerable versions prior to 11.0.1, the application fails to implement sanity checks or size limits on the output buffer during the decompression process. When the library handles a compressed archive, it allocates memory based on the uncompressed file size presented within the archive's metadata or during the stream expansion.\nAn attacker exploits this by crafting a malicious archive, commonly referred to as a decompression bomb, which contains a high compression ratio. When parsedmarc processes this attachment, the decompression algorithm attempts to allocate a memory buffer large enough to hold the fully expanded contents.\nThe attack flow is as follows: 1. The attacker sends an email containing a malicious, highly compressed attachment to an address monitored by the parsedmarc process. 2. parsedmarc, operating in its automated ingestion mode, automatically fetches the email from the mail server. 3. The application triggers its internal processing functions to extract and decompress the attachment. 4. The underlying decompression library reads the archive and attempts to allocate a memory block proportional to the uncompressed size. 5. Due to the lack of a defined maximum buffer size or input validation, the process consumes excessive amounts of system RAM. 6. The operating system's OOM (Out of Memory) killer terminates the process, or the system hangs due to thrashing, resulting in a complete Denial of Service.\nThis vulnerability is particularly dangerous because the processing occurs without user authentication or interaction. The exposure is limited only by the attacker's ability to send emails to the monitored account. Because the extraction occurs early in the processing lifecycle, the system is unable to filter or reject the payload before the resource-intensive operation is initiated.\nThe post-exploitation impact is focused on availability. While this specific vulnerability does not provide a direct vector for Remote Code Execution (RCE), the inability to process DMARC reports prevents security teams from identifying and mitigating spoofing attempts, thereby reducing the overall security posture of the affected domain's email infrastructure."
}