CyberRota Analysis
AI-GeneratedParsedmarc versions prior to 11.0.1 are vulnerable to a denial-of-service attack due to improper handling of gzip and ZIP attachments, allowing unauthenticated remote attackers to exploit this flaw by sending specially crafted emails. The lack of limits on decompressed output size can lead to excessive memory allocation, potentially exhausting system RAM and disrupting service. Organizations using parsedmarc for DMARC report processing should prioritize patching to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.