CVE-2026-82520
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.
वीकनेस
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.
संदर्भ
- https://github.com/domainaware/parsedmarc/releases/tag/11.0.1
- https://github.com/domainaware/parsedmarc/security/advisories/GHSA-43qf-f35w-2x4r
- https://www.vulncheck.com/advisories/parsedmarc-zip-bomb-dos-via-compressed-email-attachments
- https://github.com/domainaware/parsedmarc/security/advisories/GHSA-43qf-f35w-2x4r
हमलावर से पहले बग आप ढूँढें।
GitHub से साइन इन करें और एक मिनट से भी कम में अपना पहला ऑडिट चलाएँ। फ़्री प्लान के लिए क्रेडिट कार्ड की ज़रूरत नहीं।