GHSA-8c8m-p3m8-cjg8
MediumSummary
RFC 5322 comments can be nested, but addressparser ends a comment at the first `)`, including the one closing a nested comment, and parses the remainder of the outer comment as header text. This leads to incorrect email address interpretation.
Risk Assessment
An attacker can craft an email header to mislead the parser and cause incorrect sender address attribution, potentially resulting in spoofing or filter bypass.
Recommendation
Update addressparser to a patched version that handles nested comments per RFC 5322. Test the application for susceptibility to crafted headers.
Other vulnerabilities in addressparser
See all- GHSA-v53p-9fqp-m79jHigh
When addressparser finds no address by its strict reading, it falls back to pulling one out of the free text with /\s*\b[^@\s]+@[^\s]+\b\s*/. That pattern backtracks quadratically, causing high resource consumption when processing a single header.
- GHSA-m943-m63m-w62wMedium
addressparser ends an RFC 5322 group at the first `;`, even when it appears inside a quoted display name or a comment. The text after it is re-parsed as top-level recipients with quoting flipped, so text that a conformant parser reads as a display name or comment is misinterpreted.
- GHSA-85x2-q946-cp5hMedium
The addressparser library ends angle-addr parsing at the first `>` it encounters, even when that character appears inside a quoted local part, a comment, or a domain literal. The domain is then read from the text preceding that `>`, resulting in incorrect email address interpretation.
Original NVD description (English source)
### Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) <[email protected]>) <[email protected]>` names `[email protected]` with `x(y) <[email protected]>`
Vulnerability data from NVD (NIST) · CISA KEV · EPSS