CVE-2026-82520

HIGH 7.5

parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.

CWE	CWE-409
Vendor	domainaware
Product	parsedmarc
Published	Sep 3, 2026

Stay Ahead of the Next One

Get instant alerts for domainaware parsedmarc

Be the first to know when new high vulnerabilities affecting domainaware parsedmarc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

domainaware / parsedmarc

0 < 11.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/domainaware/parsedmarc/security/advisories/GHSA-43qf-f35w-2x4r github.com: https://github.com/domainaware/parsedmarc/releases/tag/11.0.1 vulncheck.com: https://www.vulncheck.com/advisories/parsedmarc-zip-bomb-dos-via-compressed-email-attachments

Credits

Abdulxay Sharofiddinov VulnCheck