AIKIDO-2026-527160

TL;DR

The library relies on two regular expressions in its email header parsing that exhibit polynomial backtracking on externally supplied input. An address-header fallback pattern degrades to quadratic or cubic time on padded display names or repeated angle brackets, and the Received header clause splitter backtracks quadratically over long whitespace runs. Because both patterns run through the standard parsing entry points, a single small but crafted email can consume large amounts of CPU and stall a mail-processing worker. The fix replaces the patterns with linear-time scanning and collapses whitespace runs before splitting.