Executive brief
parsedmarc is a DMARC report parser that automatically processes incoming email reports without user interaction. A remote attacker can send a specially crafted email with a highly compressed gzip or ZIP attachment to trigger unbounded decompression, exhausting server memory and causing a denial of service. A 25 MB compressed attachment can expand to 25 GB in RAM, crashing the application or host.
Technical details
The vulnerability is an unbounded decompression flaw in parsedmarc's extract_report() function. The vulnerable code uses zlib.decompress() for gzip and zipfile.ZipFile.open().read() for ZIP attachments without checking the decompressed output size. An unauthenticated remote attacker can send an email with a malicious attachment achieving compression ratios of ~1000:1 to the monitored mailbox; since parsedmarc automatically processes DMARC report emails, the attachment is decompressed entirely into memory without limits, exhausting available RAM. The fix (version 11.0.1) enforces a 100 MiB decompression limit, aborting extraction if exceeded, and is deliberately non-configurable to prevent bypasses.
Affected products
- domainaware parsedmarc before 11.0.1
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 11.0.1