AIKIDO-2026-150275

TL;DR

Sender-chosen header names are resolved through Python attribute lookup and rewritten before lookup, folding underscores to dashes and interpreting _json and _raw suffixes. A header named after a class method or carrying raw 8-bit bytes raises an exception outside the MailParser error hierarchy, so callers catching only library errors let the worker die, and header values can be silently dropped or replaced by another header's value while has_defects stays false, giving a detection-evasion primitive. The parsed output then diverges from the bytes actually present in the message. The fix looks up header names literally without attribute access or suffix interpretation, coerces 8-bit values to text before serialization, and initializes parser state before the message check.