What is CVE-2026-82520?

CVE-2026-82520 is a high-severity vulnerability, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 7.5/10. Published 2026-09-03.

How severe is CVE-2026-82520?

High severity. CVSS v3 base score is 7.5 out of 10.

CVE-2026-82520

CVE-2026-82520

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Weakness classification (CWE)

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification)

References

Frequently asked questions

What is CVE-2026-82520?: CVE-2026-82520 is a high-severity vulnerability, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 7.5/10. Published 2026-09-03.
How severe is CVE-2026-82520?: High severity. CVSS v3 base score is 7.5 out of 10.