CVE-2026-82520

Name of the Vulnerable Software and Affected Versions parsedmarc versions prior to 11.0.1

Description The software decompresses gzip and ZIP attachments using a single unbounded read without limiting the decompressed output size. Since incoming DMARC report emails are processed automatically without user interaction, an unauthenticated remote attacker can send a crafted email containing a highly compressed attachment. This leads to the process allocating memory proportional to the uncompressed size, resulting in the exhaustion of available RAM.

Recommendations Update to version 11.0.1 or later.