EUVD-2026-70740Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Email delivery to a public mailbox requires no authentication or user interaction; only availability is affected via OOM crash, with no confidentiality or integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.
AnalysisAI
Unbounded decompression of gzip and ZIP attachments in parsedmarc before 11.0.1 exposes any organization running automated DMARC report processing to remote, unauthenticated denial of service. Because extract_report() inflates compressed attachments with no size ceiling, a decompression bomb exploiting deflate's ~1000:1 ratio on degenerate input - e.g., a 100 KB attachment expanding to ~100 MB in RAM, with peak usage near 200 MB - exhausts host memory when parsedmarc auto-processes the email. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only the ability to deliver an email to the mailbox that parsedmarc monitors for DMARC reports - the rua= or ruf= address published in the target's public DNS DMARC record. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N and VA:H accurately reflects the technical profile: zero authentication, zero complexity, zero user interaction, and reliable availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to parsedmarc 11.0.1, available at https://github.com/domainaware/parsedmarc/releases/tag/11.0.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running parsedmarc and determine deployed versions; prioritize instances processing high-volume email feeds or supporting critical compliance workflows. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Parsedmarc
View allShare
External POC / Exploit Code
Leaving vuln.today