Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck

CVE-2026-82520parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments

High 7.5

In plain English

A high-severity security flaw in parsedmarc from domainaware. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 43.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.

Affected products (as reported)

Vendor	Product	Versions
domainaware	parsedmarc	0 – before 11.0.1

Weakness: CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-43qf-f35w-2x4r) vendor-advisory
Release Notes release-notes, patch
https://www.vulncheck.com/advisories/parsedmarc-zip-bomb-dos-via-compressed-email-attachments third-party-advisory