CVE-2023-36632

The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.

• CWE-674

• https://docs.python.org/3/library/email.htmlProduct
• https://docs.python.org/3/library/email.utils.htmlProduct
• https://github.com/Daybreak2019/PoC_python3.9_Vul/blob/main/RecursionError-email.utils.parseaddr.pyProduct
• https://github.com/python/cpython/issues/103800Exploit, Issue Tracking
• https://docs.python.org/3/library/email.htmlProduct
• https://docs.python.org/3/library/email.utils.htmlProduct
• https://github.com/Daybreak2019/PoC_python3.9_Vul/blob/main/RecursionError-email.utils.parseaddr.pyProduct
• https://github.com/python/cpython/issues/103800Exploit, Issue Tracking

Published

Jun 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36627A flaw exists in FlashBlade Purity whereby a user with acces…2.7
• CVE-2023-36628A flaw exists in VASA which allows users with access to a vS…8.8
• CVE-2023-36629The ST ST54-android-packages-apps-Nfc package before 130-202…5.5
• CVE-2023-3663In CODESYS Development System versions from 3.5.11.20 and be…8.8
• CVE-2023-36630In CloudPanel before 2.3.1, insecure file upload leads to pr…8.8
• CVE-2023-36631Lack of access control in wfc.exe in Malwarebytes Binisoft W…7.8
• CVE-2023-36633An improper authorization vulnerability [CWE-285] in FortiMa…5.4
• CVE-2023-36634An incomplete filtering of one or more instances of special …8.8
• CVE-2023-36635An improper access control in Fortinet FortiSwitchManager ve…4.3
• CVE-2023-36636Rejected reason: Not used
• CVE-2023-36637An improper neutralization of input during web page generati…5.4
• CVE-2023-36638An improper privilege management vulnerability [CWE-269] in …4.3