parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.

CVE-2026-82520 affects parsedmarc before version 11.0.1, a tool used to parse DMARC aggregate and forensic reports. The vulnerability exists because parsedmarc decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Since parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can exploit this by sending a crafted email containing a highly compressed (zip bomb) attachment to the monitored mailbox. Upon processing, the parsedmarc process allocates memory proportional to the uncompressed size of the attachment, which can exhaust all available RAM on the host system. This constitutes a Denial of Service (DoS) attack vector requiring no authentication or user interaction. The issue has been patched in parsedmarc version 11.0.1. Organizations running automated DMARC report processing pipelines using parsedmarc should upgrade immediately to mitigate the risk of resource exhaustion attacks.