Potential Quadratic Complexity Vulnerabilities in the `email` Module

Bug Description:
A series of simple quadratic complexity vulnerabilities has been identified in the email package. After confirmation by CPython's security team, these low-threat DOS vulnerabilities can be fixed with community assistance.

Vulnerability Locations (All Fixed):

1. https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/message.py#L73
   2.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L1424
   3.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L1506
   4.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L1688
   5.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L1697
   6.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L1847
   7.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2200
   8.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2231
   9.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2260
   10.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2411
   11.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2570
   12.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2642
   13.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2762
   14.https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_header_value_parser.py#L2965

Below are the newly identified DoS risk points in the email module, added on 2026/01/23, updated from https://github.com/python/cpython/issues/144133:

15. https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/email/_header_value_parser.py#L2838
16. https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/email/_header_value_parser.py#L3076
17. https://github.com/python/cpython/blob/e66597d6c84a8615340822b8da564e5ca3fba5cd/Lib/email/message.py#L879
18. https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_parseaddr.py#L527
19. https://github.com/python/cpython/blob/5ab66a882d1b5e44ec50b25df116ab209d65863f/Lib/email/_parseaddr.py#L551
20. https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L319
21. https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L354

more:

TokenList.all_defects: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L152-L154
AddressList.mailboxes: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L313-L316
get_encoded_word: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1074-L1121
get_unstructured: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1123-L1188
get_bare_quoted_string: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1238-L1279
get_comment: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1281-L1304
get_dot_atom_text: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1364-L1381
get_dot_atom: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1383-L1406
get_word: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1408-L1440
get_local_part: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1480-L1517
get_domain: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1638-L1674
get_addr_spec: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1676-L1690
get_angle_addr: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1735-L1779
get_display_name: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1781-L1793
get_name_addr: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1796-L1830
get_mailbox: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1832-L1851
get_mailbox_list: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1871-L1925
get_group_list: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1928-L1963
get_group: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1965-L1993
get_address: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L1995-L2022
get_address_list: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L2024-L2076
get_msg_id: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L2101-L2167
parse_message_id: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L2170-L2188
parse_mime_parameters: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_header_value_parser.py#L2627-L2677
AddrlistClass.getaddress: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/_parseaddr.py#L274-L331
Charset.header_encode_lines: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/charset.py#L293-L352
decode_header: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/header.py#L59-L156
Header._normalize: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/header.py#L398-L414
Message.set_param: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/message.py#L745-L794
Message.del_param: https://github.com/python/cpython/blob/6181b69970b93fc74d74c97ce6543c0d1b6a258c/Lib/email/message.py#L796-L816

Repair Status:

• @picnixz is currently fixing all listed vulnerabilities in the email package (#134947).

Common Information:

• CPython Version: main branch
• Operating System: Linux
• Credits: Finder is kexinoh (Xiangfan Wu) from QI-ANXIN Technology Research Institute.

Linked PRs

• gh-134947
• gh-136072
• gh-140827
• gh-140828
• gh-140829
• gh-140830
• gh-140831
• gh-140832
• gh-152521
• gh-152710

首先查看相关的 PR：gh-134947、gh-136072、gh-140827 至 gh-140832、gh-152521 和 gh-152710。报告的位置主要位于 Lib/email/_header_value_parser.py，message.py、_parseaddr.py、charset.py 和 header.py 中还有其他位置；在考虑任何剩余工作之前，将 PR 的覆盖范围与列出的函数和测试进行比较。