CVE-2026-82520
Last modified
CVE-2026-82520 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM..
Description
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| domainaware | parsedmarc | < 11.0.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-82520?
How severe is CVE-2026-82520?
How do I fix CVE-2026-82520?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-82487A vulnerability was determined in Beetel 450TC3 01.00.00_01.…6.3
- CVE-2026-82488A vulnerability was identified in Beetel 450TC3 01.00.00_01.…3.5
- CVE-2026-8249A flaw has been found in Open5GS up to 2.7.7. The impacted e…6.5
- CVE-2026-8250A vulnerability has been found in Open5GS up to 2.7.7. This …6.5
- CVE-2026-8251A vulnerability was found in Open5GS up to 2.7.7. This impac…6.5
- CVE-2026-8252A vulnerability was determined in Open5GS up to 2.7.7. Affec…6.5
- CVE-2026-82521parsedmarc 9.0.6 before 11.0.1 writes forensic report sample…5.3
- CVE-2026-82522libjxl before 0.12 contains an integer underflow vulnerabili…5.4
- CVE-2026-82524UnoPim before 2.1.5 contains an authenticated file upload vu…7.2
- CVE-2026-82525Exterro FTK Imager before 8.3 contains an XML external entit…5.5
- CVE-2026-82526R2R through 3.6.6 contains a stacked SQL injection vulnerabi…9.8
- CVE-2026-82527R2R through 3.6.6 contains a SQL injection vulnerability tha…7.5
Are you affected by CVE-2026-82520?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST