CVE-2026-82520: parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments running parsedmarc before 11.0.1 that automatically process incoming DMARC report emails are exposed. A monitored mailbox that can receive attacker-sent email provides the delivery path.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They need only send a crafted email containing a highly compressed gzip or ZIP attachment to the mailbox parsedmarc monitors.
What is the operational impact of a successful attack?
parsedmarc can allocate memory proportional to the attachment's uncompressed size because decompression occurs in one unbounded read. This can exhaust available RAM and cause a denial of service.
What can be done if an upgrade cannot be applied immediately?
The provided information identifies no specific workaround. Reducing or restricting untrusted email delivery to the monitored mailbox would limit the stated attack path.