CVE-2026-82520: Improper Handling of Highly Compressed Data (Data Amplification) in domainaware parsedmarc

The vulnerability in parsedmarc before version 11.0.1 involves unbounded decompression of gzip and ZIP attachments in incoming DMARC report emails. Because parsedmarc automatically processes these emails without user interaction, an attacker can exploit this by sending a crafted email containing a highly compressed attachment. The decompression process allocates memory proportional to the uncompressed size without limits, leading to potential exhaustion of system RAM and denial of service conditions.

An unauthenticated remote attacker can cause a denial of service by sending a specially crafted email with a highly compressed attachment to the monitored mailbox. The parsedmarc process will decompress the attachment without bounds, consuming excessive memory and potentially crashing or severely degrading the service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external controls such as limiting the size of incoming emails or attachments at the mail server level to mitigate the risk of resource exhaustion.