The vulnerability lies in parsedmarc's handling of compressed email attachments. The tool decompresses gzip and ZIP attachments using a single read that has no safeguard against extreme compression, so an attacker can craft a small file that expands to a very large uncompressed form. When processed, parsedmarc allocates memory proportional to that size, causing the process to consume all available RAM and become unresponsive, effectively denying service to legitimate users. This weakness is related to unchecked resource consumption.

Domainaware's parsedmarc versions earlier than 11.0.1 are affected. Any deployment running a pre‑11.0.1 release will process inbound DMARC report emails without user intervention, exposing the vulnerability to any external sender of specially crafted attachments.

The CVSS score of 8.7 indicates a high severity. An attacker needs only to send an email to the monitored mailbox; no authentication or special privileges are required. The EPSS score is not available, but the absence of authentication bottlenecks combined with the potentially unlimited size of the compressed payload means exploitation is likely easy if the system is reachable. This vulnerability is not currently listed in the CISA KEV catalog, but its impact and accessibility make it a serious threat for exposed deployments.