gh-136063: fix quadratic-complexity parsing in `email.message._parseparam` - #136072

Merged

ambv merged 4 commits into

python:mainfrom

picnixz:fix/email/parseparam-dos-136063

Oct 31, 2025

picnixz commented Jun 28, 2025•
edited by bedevere-app Bot
Loading

Member

@serhiy-storchaka I think this one can be done without changing the interface. Just to be sure, but count() and find() have all linear complexities right (linear in the window they are using, not in the entire string).

Issue: Potential Quadratic Complexity Vulnerabilities in the email Module #136063

fix quadratic-complexity parsing in email.message._parseparam

6786f73

bedevere-appBot mentioned this pull request

Potential Quadratic Complexity Vulnerabilities in the email Module #136063

Open

fix tests

d356a14

picnixz force-pushed the fix/email/parseparam-dos-136063 branch from 8763366 to d356a14Compare

June 28, 2025 12:44

picnixz requested a review from serhiy-storchaka

June 28, 2025 12:49

picnixz marked this pull request as ready for review

June 28, 2025 12:49

picnixz requested a review from a team as a code owner

June 28, 2025 12:49

bedevere-appBot added the awaiting core review label

picnixz added the type-security label

aeurielesn reviewed

View reviewed changes

Lib/email/message.py Outdated

picnixz marked this pull request as draft

July 20, 2025 07:54

bedevere-appBot removed the awaiting core review label

eliminate quadratic time complexity when counting

2ea02f9

picnixz marked this pull request as ready for review

July 20, 2025 09:09

bedevere-appBot added the awaiting core review label

picnixz added needs backport to 3.9 needs backport to 3.10 needs backport to 3.11 needs backport to 3.12 needs backport to 3.13 needs backport to 3.14 labels

picnixz commented Jul 29, 2025

MemberAuthor

@serhiy-storchaka friendly ping

remove comment

24361c9

ambv merged commit 680a5d0 into python:main

45 checks passed

miss-islington-appBot commented Oct 31, 2025

Thanks @picnixz for the PR, and @ambv for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

bedevere-appBot removed the awaiting core review label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

pythongh-136063: fix quadratic-complexity parsing in `email.message._…

7a8ebb2

…parseparam` (pythonGH-136072)
(cherry picked from commit 680a5d0)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

pythongh-136063: fix quadratic-complexity parsing in `email.message._…

67e8c17

…parseparam` (pythonGH-136072)
(cherry picked from commit 680a5d0)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-appBot commented Oct 31, 2025

GH-140827 is a backport of this pull request to the 3.14 branch.

bedevere-appBot removed the needs backport to 3.14 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

pythongh-136063: fix quadratic-complexity parsing in `email.message._…

f8f3e70

…parseparam` (pythonGH-136072)
(cherry picked from commit 680a5d0)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-appBot commented Oct 31, 2025

GH-140828 is a backport of this pull request to the 3.13 branch.

bedevere-appBot removed the needs backport to 3.13 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

pythongh-136063: fix quadratic-complexity parsing in `email.message._…

134369a

…parseparam` (pythonGH-136072)
(cherry picked from commit 680a5d0)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-appBot commented Oct 31, 2025

GH-140829 is a backport of this pull request to the 3.12 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

pythongh-136063: fix quadratic-complexity parsing in `email.message._…

3d1bc22

…parseparam` (pythonGH-136072)
(cherry picked from commit 680a5d0)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-appBot removed the needs backport to 3.12 label

bedevere-appBot commented Oct 31, 2025

GH-140830 is a backport of this pull request to the 3.11 branch.

bedevere-appBot removed the needs backport to 3.11 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

pythongh-136063: fix quadratic-complexity parsing in `email.message._…

bbebf3b

…parseparam` (pythonGH-136072)
(cherry picked from commit 680a5d0)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

bedevere-appBot commented Oct 31, 2025

GH-140831 is a backport of this pull request to the 3.10 branch.

bedevere-appBot removed the needs backport to 3.10 label

bedevere-appBot commented Oct 31, 2025

GH-140832 is a backport of this pull request to the 3.9 branch.

bedevere-appBot removed the needs backport to 3.9 label

ambv pushed a commit that referenced this pull request

[3.9]gh-136063: fix quadratic-complexity parsing in `email.message._…

90719e3

…parseparam` (GH-136072) (GH-140832)
(cherry picked from commit 680a5d0)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

ambv added a commit that referenced this pull request

[3.11]gh-136063: fix quadratic-complexity parsing in `email.message.…

3b7d81d

…_parseparam` (GH-136072) (GH-140830)
(cherry picked from commit 680a5d0)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>

picnixz deleted the fix/email/parseparam-dos-136063 branch

November 2, 2025 09:33

hugovk pushed a commit that referenced this pull request

[3.14]gh-136063: fix quadratic-complexity parsing in `email.message.…

848a2eb

…_parseparam` (GH-136072) (#140827)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

hugovk pushed a commit that referenced this pull request

[3.13]gh-136063: fix quadratic-complexity parsing in `email.message.…

b34ecec

…_parseparam` (GH-136072) (#140828)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

StanFromIreland pushed a commit to StanFromIreland/cpython that referenced this pull request

pythongh-136063: fix quadratic-complexity parsing in `email.message._…

aa928a9

…parseparam` (pythonGH-136072)

Yhg1s pushed a commit that referenced this pull request

[3.12]gh-136063: fix quadratic-complexity parsing in `email.message.…

1c00d7b

…_parseparam` (GH-136072) (#140829)
gh-136063: fix quadratic-complexity parsing in `email.message._parseparam` (GH-136072)
(cherry picked from commit 680a5d0)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

pablogsal pushed a commit that referenced this pull request

[3.10]gh-136063: fix quadratic-complexity parsing in `email.message.…

6027dbb

…_parseparam` (GH-136072) (#140831)
gh-136063: fix quadratic-complexity parsing in `email.message._parseparam` (GH-136072)
(cherry picked from commit 680a5d0)
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

picnixz mentioned this pull request

SimpleCookie regex can make parsing extremely slow for adversarial payloads #149028

Closed

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment