Potential Quadratic Complexity Vulnerabilities in the `email` Module

Bug Description:
A series of simple quadratic complexity vulnerabilities has been identified in the email package. After confirmation by CPython's security team, these low-threat DOS vulnerabilities can be fixed with community assistance.

Vulnerability Locations (All Fixed):

1. https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/message.py#L73
   2.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L1424
   3.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L1506
   4.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L1688
   5.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L1697
   6.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L1847
   7.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2200
   8.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2231
   9.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2260
   10.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2411
   11.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2570
   12.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2642
   13.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2762
   14.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2965

Below are the newly identified DoS risk points in the email module, added on 2026/01/23, updated from https://github.com/python/cpython/issues/144133:

15. https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/email/_header_value_parser.py#L2838
16. https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/email/_header_value_parser.py#L3076
17. https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/email/message.py#L879
18. https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_parseaddr.py#L527
19. https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_parseaddr.py#L551
20. https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L319
21. https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L354

more:

TokenList.all_defects: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L152-L154
AddressList.mailboxes: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L313-L316
get_encoded_word: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1074-L1121
get_unstructured: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1123-L1188
get_bare_quoted_string: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1238-L1279
get_comment: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1281-L1304
get_dot_atom_text: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1364-L1381
get_dot_atom: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1383-L1406
get_word: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1408-L1440
get_local_part: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1480-L1517
get_domain: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1638-L1674
get_addr_spec: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1676-L1690
get_angle_addr: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1735-L1779
get_display_name: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1781-L1793
get_name_addr: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1796-L1830
get_mailbox: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1832-L1851
get_mailbox_list: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1871-L1925
get_group_list: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1928-L1963
get_group: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1965-L1993
get_address: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1995-L2022
get_address_list: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L2024-L2076
get_msg_id: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L2101-L2167
parse_message_id: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L2170-L2188
parse_mime_parameters: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L2627-L2677
AddrlistClass.getaddress: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_parseaddr.py#L274-L331
Charset.header_encode_lines: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/charset.py#L293-L352
decode_header: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/header.py#L59-L156
Header._normalize: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/header.py#L398-L414
Message.set_param: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/message.py#L745-L794
Message.del_param: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/message.py#L796-L816

Repair Status:

• @picnixz is currently fixing all listed vulnerabilities in the email package (#134947).

Common Information:

• CPython Version: main branch
• Operating System: Linux
• Credits: Finder is kexinoh (Xiangfan Wu) from QI-ANXIN Technology Research Institute.

Linked PRs

• gh-134947
• gh-136072
• gh-140827
• gh-140828
• gh-140829
• gh-140830
• gh-140831
• gh-140832
• gh-152521
• gh-152710

Bắt đầu bằng việc xem xét các PR được liên kết gh-134947, gh-136072, gh-140827 đến gh-140832, gh-152521 và gh-152710. Các vị trí được báo cáo chủ yếu nằm trong Lib/email/_header_value_parser.py, với các điểm bổ sung trong message.py, _parseaddr.py, charset.py và header.py; hãy so sánh phạm vi bao phủ của các PR với các hàm và bài kiểm thử được liệt kê trước khi cân nhắc bất kỳ công việc còn lại nào.