CVE-2026-82520 parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments
An unauthenticated remote attacker can cause a denial of service by sending crafted emails with highly compressed attachments to the monitored mailbox.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82520?
CVE-2026-82520 is a high-severity denial of service vulnerability in domainaware parsedmarc, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.
Weakness: CWE-409
Which versions are affected by CVE-2026-82520?
How do I fix CVE-2026-82520?
No fix has been published for CVE-2026-82520 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-82520 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82520 exists.
Sources
Also known as GHSA-43qf-f35w-2x4r.