CVE-2023-36632: Python email.utils.parseaddr DoS Vulnerability

CVE-2023-36632 Overview

CVE-2023-36632 is a Denial of Service (DoS) vulnerability affecting the legacy email.utils.parseaddr function in Python through version 3.11.4. Attackers can exploit this vulnerability by supplying a crafted input argument designed to trigger a RecursionError: maximum recursion depth exceeded while calling a Python object exception. The malicious input could plausibly originate from untrusted application data that was expected to contain a name and email address.

It is important to note that email.utils.parseaddr is categorized as a Legacy API in the Python email package documentation. The Python vendor's position is that this behavior is neither a vulnerability nor a bug, as the email package is intentionally designed with size limits and will throw exceptions when those limits are exceeded.

Critical Impact

Applications using the legacy email.utils.parseaddr function with untrusted input may experience service disruption through resource exhaustion caused by uncontrolled recursion.

Affected Products

• Python versions through 3.11.4
• Applications utilizing the legacy email.utils.parseaddr function
• Systems processing untrusted email address input without proper validation

Discovery Timeline

• 2023-06-25 - CVE-2023-36632 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36632

Vulnerability Analysis

This vulnerability falls under CWE-674 (Uncontrolled Recursion), where the email.utils.parseaddr function fails to properly handle specially crafted input strings that cause excessive recursive function calls. When processing malicious email address strings, the parser enters a recursive loop that eventually exceeds Python's maximum recursion depth limit, causing the interpreter to raise a RecursionError exception.

The attack can be conducted over the network against any application that accepts email address input from external sources and passes it to the vulnerable parseaddr function without proper validation or exception handling. The vulnerability results in an availability impact, potentially crashing or hanging affected services.

Root Cause

The root cause stems from the legacy implementation of email.utils.parseaddr lacking adequate protections against deeply nested or malformed input structures. When presented with specifically crafted input containing nested parentheses or other recursive structures, the parsing algorithm recursively calls itself without sufficient depth checks, eventually exhausting the call stack.

The Python email package documentation explicitly marks this function as a Legacy API, recommending that developers use the more robust email.parser.BytesParser or email.parser.Parser classes instead, which include better input handling mechanisms.

Attack Vector

An attacker can exploit this vulnerability by sending a specially crafted string as input to any application endpoint that processes email addresses using the vulnerable email.utils.parseaddr function. The attack requires no authentication or user interaction, making it highly accessible to remote attackers.

The vulnerability is triggered when the parseaddr function attempts to parse a malformed email address string containing structures that induce recursive processing beyond Python's default recursion limit. A proof-of-concept demonstrating this behavior is available in the GitHub PoC repository. Technical discussions about this issue can be found in GitHub Issue #103800.

Detection Methods for CVE-2023-36632

Indicators of Compromise

• Elevated RecursionError exceptions in application logs related to email parsing
• Abnormal CPU utilization spikes when processing email-related requests
• Service crashes or unresponsive behavior during email address validation operations
• Stack traces indicating email.utils.parseaddr in the call chain

Detection Strategies

• Monitor application logs for RecursionError: maximum recursion depth exceeded messages
• Implement application-level exception monitoring for the email parsing subsystem
• Deploy runtime application self-protection (RASP) to detect and block anomalous recursion patterns
• Use static code analysis to identify usage of the legacy email.utils.parseaddr function

Monitoring Recommendations

• Configure alerting for repeated service restarts or crashes in email-processing components
• Monitor resource consumption metrics (CPU, memory) for email handling services
• Implement request rate limiting on endpoints accepting email address input
• Log and analyze input patterns to identify potential exploitation attempts

How to Mitigate CVE-2023-36632

Immediate Actions Required

• Audit codebase for usage of the legacy email.utils.parseaddr function
• Migrate to the recommended email.parser.BytesParser or email.parser.Parser classes as documented in the Python Email Library Documentation
• Implement input validation and length limits on email address fields before parsing
• Wrap parseaddr calls with exception handling to gracefully handle RecursionError

Patch Information

The Python maintainers have indicated that this behavior is by design, as the email package intentionally has size limits and throws exceptions when limits are exceeded. Rather than a patch, the recommended remediation is to migrate away from the legacy API.

Applications should transition from the legacy email.utils.parseaddr function to the modern parser classes:

• email.parser.BytesParser for binary email data
• email.parser.Parser for text email data

Consult the Python Email Utils Documentation for migration guidance.

Workarounds

• Implement input length validation before passing data to parseaddr to prevent excessively long inputs
• Set a custom recursion limit using sys.setrecursionlimit() with appropriate exception handling (use with caution)
• Add try-except blocks around parseaddr calls to catch RecursionError and handle gracefully
• Consider implementing a timeout mechanism for email parsing operations

# Example mitigation: Wrap legacy function with exception handling
# In Python application code, implement protective measures:
# 1. Validate input length before parsing
# 2. Use try-except to catch RecursionError
# 3. Consider migrating to email.parser.Parser class