AIKIDO-2026-161944
mail-parser is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
mail-parserTL;DR
Header values are resolved by looking up sender-chosen header names through Python attribute access, and caller convenience suffixes such as _json and _raw are applied to names taken off the wire. This lets a single small email trigger several amplification primitives: quadratic rescanning per distinct header name, unbounded recursion through a Headers_json header, exponential memory growth from repeated _json re-serialization, and quadratic blowup from case variants. Parsing untrusted mail can consume seconds to minutes of CPU or exhaust available memory with no authentication required. The fix resolves headers through a literal-lookup index that is constant time per header and no longer interprets suffixes on names taken from a message.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and parse untrusted email with this library.
Background info
mail-parser is vulnerable to Denial of Service (DoS) in versions 3.4.0 - 4.6.1.
How to fix this
Upgrade the mail-parser library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant