GHSA-v53p-9fqp-m79j
HighSummary
When addressparser finds no address by its strict reading, it falls back to pulling one out of the free text with /\s*\b[^@\s]+@[^\s]+\b\s*/. That pattern backtracks quadratically, causing high resource consumption when processing a single header.
Risk Assessment
An attacker can send a specially crafted header, causing significant resource consumption and potentially a denial of service.
Recommendation
Update the addressparser library to a patched version or limit the size of processed headers.
Other vulnerabilities in addressparser
See all- GHSA-m943-m63m-w62wMedium
addressparser ends an RFC 5322 group at the first `;`, even when it appears inside a quoted display name or a comment. The text after it is re-parsed as top-level recipients with quoting flipped, so text that a conformant parser reads as a display name or comment is misinterpreted.
- GHSA-85x2-q946-cp5hMedium
The addressparser library ends angle-addr parsing at the first `>` it encounters, even when that character appears inside a quoted local part, a comment, or a domain literal. The domain is then read from the text preceding that `>`, resulting in incorrect email address interpretation.
- GHSA-8c8m-p3m8-cjg8Medium
RFC 5322 comments can be nested, but addressparser ends a comment at the first `)`, including the one closing a nested comment, and parses the remainder of the outer comment as header text. This leads to incorrect email address interpretation.
Original NVD description (English source)
### Summary When `addressparser` finds no address by its strict reading, it falls back to pulling one out of the free text with `/\s*\b[^@\s]+@[^\s]+\b\s*/`. That pattern backtracks quadratically: `[^@\s]+` is retried from every offset and rescans the run to the next `@` each time. A single header
Vulnerability data from NVD (NIST) · CISA KEV · EPSS