{"id":"CVE-2023-36632","aliases":["AZL-109665","BIT-libpython-2023-36632","BIT-python-2023-36632","BIT-python-min-2023-36632","EUVD-2023-40576","GHSA-gv66-v8c8-v69c","PSF-2023-4"],"status":"disputed","title":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger ...","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01584,"percentile":0.75743,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2023-06-25T00:00:00Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Bitnami","package":"libpython","fixed_in":["3.11.5"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python","fixed_in":["3.11.5"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python-min","fixed_in":["3.11.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.11.0-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"libpython","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.5"}]}]}],"products":[{"vendor":"python","product":"python"}],"references":[{"url":"https://docs.python.org/3/library/email.utils.html","tags":["x_transferred","Product","web"]},{"url":"https://docs.python.org/3/library/email.html","tags":["x_transferred","Product","web"]},{"url":"https://github.com/Daybreak2019/PoC_python3.9_Vul/blob/main/RecursionError-email.utils.parseaddr.py","tags":["x_transferred","Product","web"]},{"url":"https://github.com/python/cpython/issues/103800","tags":["x_transferred","Exploit","Issue Tracking","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36632","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gv66-v8c8-v69c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36632.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-36632","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.","status":"disputed","published":"2023-06-25T00:00:00Z","modified":"2024-11-27T19:46:48.884Z","updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2023-40576","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.","status":"published","published":"2023-06-25T00:00:00Z","modified":"2024-11-27T19:46:48Z","updated_at":"2026-11-03T00:04:45.257697Z"}],"ghsa":[{"id":"GHSA-gv66-v8c8-v69c","title":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger ...","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class.","status":"published","published":"2023-06-25T18:30:27Z","modified":"2023-11-06T05:02:44Z","updated_at":"2026-11-02T14:54:51.575138Z"}],"nvd":[{"id":"CVE-2023-36632","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.","status":"disputed","published":"2023-06-25T18:15:09.313Z","modified":"2026-06-17T06:06:42.71Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:08:12.414559Z"}],"osv":[{"id":"AZL-109665","title":"CVE-2023-36632 affecting package python-py 1.11.0-1","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.","status":"published","published":"2023-06-25T18:15:09Z","modified":"2026-10-27T05:36:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"BIT-libpython-2023-36632","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.","status":"published","published":"2025-08-11T13:52:24.684Z","modified":"2026-09-08T08:48:08.930791108Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-python-2023-36632","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.","status":"published","published":"2024-03-06T11:03:32.381Z","modified":"2026-09-08T08:48:18.906527283Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"BIT-python-min-2023-36632","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.","status":"published","published":"2025-01-16T07:21:21.1Z","modified":"2026-09-08T08:47:30.079164337Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"CVE-2023-36632","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.","status":"published","published":"2023-06-25T00:00:00Z","modified":"2026-10-28T02:31:05.958656156Z","updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"PSF-2023-4","description":"The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \"RecursionError: maximum recursion depth exceeded while calling a Python object\" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.","status":"published","published":"2023-06-25T00:00:00Z","modified":"2025-08-11T15:13:42.330294Z","cwes":["CWE-674"],"updated_at":"2026-11-02T15:52:50.263679Z"}]}}