[issue31449] Potential DoS Attack when Parsing Email with Huge Number of MIME Parts

2017-09-13 Thread R. David Murray
R. David Murray added the comment: 10 million mime parts? That sounds like the kind of thing rfc 1870 was designed to address in a more general fashion (ie: the SMTP server should be enforcing maximum message size if you are worried about DOS attacks). 1 million = 3 seconds, 10 million = "ove

[issue31449] Potential DoS Attack when Parsing Email with Huge Number of MIME Parts

2017-09-13 Thread Christian Koßmann
New submission from Christian Koßmann: Python's email parser consumes a lot of resources (CPU and memory) when parsing emails with a large amount of MIME parts. Attackers can probably exploit this behavior to perform denial-of-service (DoS) attacks. A potentially malicious email has the follow