CVE-2026-82520

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in DMARC report emails in a single unbounded read with no limit on decompressed output size (CWE-409). Because the tool automatically processes incoming DMARC aggregate reports sent to a monitored mailbox, an unauthenticated remote attacker who knows or guesses that mailbox address can send a crafted email containing a highly compressed attachment, with no user interaction required. Decompression allocates memory proportional to the uncompressed size, allowing the attacker to exhaust available RAM and crash or stall the parsedmarc process — a denial-of-service condition with availability impact only (CVSS 4.0: 8.7). Any organization running an affected version to process DMARC reports via a reachable mailbox is exposed, and the report mailbox address may be discoverable from publicly published DMARC DNS records. As of now there is no public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation, consistent with its modest 0.4% EPSS probability.

What to do: Upgrade parsedmarc to 11.0.1 or later, which bounds decompressed output size. As interim mitigation, restrict delivery to the monitored DMARC report mailbox (noting its address may be published in the domain's DMARC DNS record), cap inbound message and attachment sizes at the mail gateway, and alert on abnormal memory consumption by the parsedmarc process. No public exploit is known, but because the mailbox is unauthenticated and reachable, patching should be treated as a priority.