The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exc…

published 2023-06-25 3 y ago modified 2026-09-08 2 mo ago also BIT-libpython-2023-36632 , BIT-python-2023-36632 , BIT-python-min-2023-36632 , EUVD-2023-40576

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.6%; EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits: 0; none known

The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.parseaddr is categorized as a Legacy API in the documentation of the Python email package. Applications should instead use the email.parser.BytesParser or email.parser.Parser class. NOTE: the vendor's perspective is that this is neither a vulnerability nor a bug. The email package is intended to have size limits and to throw an exception when limits are exceeded; they were exceeded by the example demonstration code.

Patch / fix

fixed in 3

bitnami libpython 3.11.5
bitnami python 3.11.5
bitnami python-min 3.11.5

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-36632 updated 2026-11-07 cvss 0.0

python: RecursionError: maximum recursion depth exceeded while calling a Python object

Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, python3, tkinter, python-libs, python-test, python-tools, +4 more Red Hat Enterprise Linux 8 numpy, scipy, PyYAML, python2, python3, mod_wsgi, +88 more Red Hat Enterprise Linux 9 python3, python3.9, python3.11, python3-idle, python3-libs, python3-test, +6 more Red Hat Software Collections rh-python38-python, rh-python38-python-idle, rh-python38-python-libs, rh-python38-python-test, rh-python38-python-tkinter, rh-python38-python-rpm-macros, +1 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 23 mo ago (2024-11-27)

Exploit prediction

1.58% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/python/cpython/issues/103800 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	libpython	<3.11.5	3.11.5
bitnami	python	<3.11.5	3.11.5
bitnami	python-min	<3.11.5	3.11.5

Classification

Weakness

CWE-674 Uncontrolled Recursion

References

github.com /python/cpython/issues/103800
exploit, issue-tracking, evidence
docs.python.org /3/library/email.utils.html
product, web
docs.python.org /3/library/email.html
product, web
github.com /Daybreak2019/PoC_python3.9_Vul/blob/main/RecursionError-email.utils.parseaddr.py
product, web
nvd.nist.gov /vuln/detail/CVE-2023-36632
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary