ReDoS vulnerability in email regex in mixin.py (feedparser ≤ 6.0.11)

[kmanan]

Hi, I came across this potential vulnerability and previously reached out Kurt, it's been over a month so going to post it kinda publicly.

Summary

feedparser ≤ 6.0.11 (and confirmed in the 6.0.12 dev branch) contains a ReDoS vulnerability in the email regex inside _sync_author_detail() in feedparser/mixin.py.

Affected Code

File: feedparser/mixin.py ~line 746
Pattern: (([a-zA-Z0-9\-]+\.)+)

The nested quantifier causes O(n²) backtracking when a crafted string is processed.

Impact

An attacker hosting a malicious RSS/Atom feed can cause CPU exhaustion in any application calling feedparser.parse(feed_url). Multiple elements linearly amplify the impact.

Proof of Concept

https://gist.github.com/kmanan/3ef665c68463fa3dddb593aff4ac0405

Run: pip install feedparser && python feedparser_redos_poc.py

Proposed Fix

Replace the nested quantifier with a flat character class:
[a-zA-Z0-9\-.]+ (no nesting)

The PoC includes a safe regex comparison (Part 5) confirming the fix processes identical inputs in constant/linear time.

Disclosure Timeline

• Reported to Snyk: ~3/16/2026
• Maintainer notified: 3/9/2026
• Public disclosure: today

[jacopotediosi]

Hi, I came across this potential vulnerability and previously reached out Kurt, it's been over a month so going to post it kinda publicly.

Same experience as you: I found some XSS vulnerabilities, I reported them a month ago via email but I was just ignored.
Now I'm compiling the Snyk form asking for a public disclosure in two months.

[kmanan]

Update: The PoC is now hosted in a dedicated public repo with corrected line references (feedparser/mixin.py:42-43 for the regex, line 783 for _sync_author_detail()) and a byte-for-byte copy of the source regex:

https://github.com/kmanan/feedparser-redos-poc

CVE assignment is in progress via the PyPA Advisory Database, GitHub Security Advisory program, and Snyk.