email.utils.parseaddr(strict=True) accepts angle address without closing '>'

[augusto-rehfeldt]

Bug report

Bug description:

Documented behaviour: email.utils.parseaddr docstring: "If strict is True, use a strict parser which rejects malformed inputs." It also states: "Return a tuple of realname and email address, unless the parse fails, in which case return a 2-tuple of ('', '')."

Expected: ('', '')

Actual: ('Alice', 'alice@example.com')

import re
from email.utils import parseaddr

n, a = "Alice", "alice@example.com"
s = n + " <" + a
if not (re.fullmatch(r"[A-Za-z]+", n, re.ASCII) and
        re.fullmatch(r"[A-Za-z]+@[A-Za-z]+\.[A-Za-z]+", a, re.ASCII)):
    print("REFUTATION REJECTED: invalid display-name atom or addr-spec")
else:
    # This valid name and addr-spec lack the angle address's required '>'.
    expected = ("", "") if s.count("<") != s.count(">") else None
    try:
        actual = parseaddr(s, strict=True)
    except Exception as e:
        print(f"REFUTATION REJECTED: {type(e).__name__}: {e}")
    else:
        if expected is not None and actual != expected:
            print(f"REFUTATION CONFIRMED: {s!r} actual={actual!r} expected={expected!r}")
        else:
            print("REFUTATION REJECTED: malformed input was rejected")

Output on Python 3.14.6 (Windows-11-10.0.26220-SP0), standard library email.utils:

REFUTATION CONFIRMED: 'Alice <alice@example.com' actual=('Alice', 'alice@example.com') expected=('', '')

This report was found and written by an automated property-testing tool I run (bugforge). The reproducer above was executed and its output is pasted unedited; no person reviewed the report before it was filed. The search script is in https://github.com/augusto-rehfeldt/bugforge-results/tree/main/email.utils-20261003-092603-c3

CPython versions tested on:

3.14

Operating systems tested on:

Windows

[ZeroIntensity]

See #158748 (comment).