Bug Description:
A series of simple quadratic complexity vulnerabilities has been identified in theemail package. After confirmation by CPython's security team, these low-threat DOS vulnerabilities can be fixed with community assistance.

Vulnerability Locations (All Fixed):

1. cpython/Lib/email/message.py

   Line 73 in5ab66a8

   def_parseparam(s):

   
   2.

   cpython/Lib/email/_header_value_parser.py

   Line 1424 in5ab66a8

   defget_phrase(value):

   
   3.

   cpython/Lib/email/_header_value_parser.py

   Line 1506 in5ab66a8

   whilevalueand (value[0]=='\\'orvalue[0]notinPHRASE_ENDS):

   
   4.

   cpython/Lib/email/_header_value_parser.py

   Line 1688 in5ab66a8

   value=value[1:]

   
   5.

   cpython/Lib/email/_header_value_parser.py

   Line 1697 in5ab66a8

   value=value[1:]

   
   6.

   cpython/Lib/email/_header_value_parser.py

   Line 1847 in5ab66a8

   value=value[1:]

   
   7.

   cpython/Lib/email/_header_value_parser.py

   Line 2200 in5ab66a8

   value=value[1:]

   
   8.

   cpython/Lib/email/_header_value_parser.py

   Line 2231 in5ab66a8

   value=value[1:]

   
   9.

   cpython/Lib/email/_header_value_parser.py

   Line 2260 in5ab66a8

   value=value[1:]

   
   10.

   cpython/Lib/email/_header_value_parser.py

   Line 2411 in5ab66a8

   value=value[1:]

   
   11.

   cpython/Lib/email/_header_value_parser.py

   Line 2570 in5ab66a8

   value=value[1:]

   
   12.

   cpython/Lib/email/_header_value_parser.py

   Line 2642 in5ab66a8

   value=value[1:]

   
   13.

   cpython/Lib/email/_header_value_parser.py

   Line 2762 in5ab66a8

   value=value[1:]

   
   14.

   cpython/Lib/email/_header_value_parser.py

   Line 2965 in5ab66a8

   to_encode=to_encode[1:]

Repair Status:

• @picnixz is currently fixing all listed vulnerabilities in the email package (gh-136063: fix various quadratic worst-time complexities in_header_value_parser.py [WIP] #134947).

Common Information:

• CPython Version: main branch
• Operating System: Linux
• Credits: Finder is kexinoh (Xiangfan Wu) from QI-ANXIN Technology Research Institute.

Linked PRs

• gh-136063: fix various quadratic worst-time complexities in_header_value_parser.py [WIP] #134947
• gh-136063: fix quadratic-complexity parsing inemail.message._parseparam #136072
• [3.14] gh-136063: fix quadratic-complexity parsing inemail.message._parseparam (GH-136072) #140827
• [3.13] gh-136063: fix quadratic-complexity parsing inemail.message._parseparam (GH-136072) #140828
• [3.12] gh-136063: fix quadratic-complexity parsing inemail.message._parseparam (GH-136072) #140829
• [3.11] gh-136063: fix quadratic-complexity parsing inemail.message._parseparam (GH-136072) #140830
• [3.10] gh-136063: fix quadratic-complexity parsing inemail.message._parseparam (GH-136072) #140831
• [3.9] gh-136063: fix quadratic-complexity parsing inemail.message._parseparam (GH-136072) #140832