Read the docs
TI-2026-40148 Aliases CVE-2026-55619GHSA-m66c-fw79-6359

eml_parser: Parser DoS via deeply nested parentheses in e-mail headers

Priority LOW 31CWE-1124Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Fixed eml_parser (GOVCERT-LU): 3.0.2eml_parser (PyPI): 3.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GOVCERT-LUeml_parserbefore 3.0.23.0.2Patch availableCNA
—eml_parser (PyPI)before 3.0.23.0.2Patch availableGHSA-m66c-fw79-6359
  • eml_parser VendorGOVCERT-LU Affected before 3.0.2 Fixed in 3.0.2 Patch available CNA
  • eml_parser (PyPI) Vendor— Affected before 3.0.2 Fixed in 3.0.2 Patch available GHSA-m66c-fw79-6359

Remediation

  • Fix · CNA eml_parser (GOVCERT-LU) Fixed in 3.0.2
  • Fix · GHSA-m66c-fw79-6359 eml_parser (PyPI) Fixed in 3.0.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55619
  2. 2026-10-03 Alias added: GHSA-m66c-fw79-6359

References

Other 5

  • TI-2026-32722 eml_parser: Recursion DoS via nested message/rfc822 attachments CVSS 4.0MEDIUM 6.3
  • TI-2026-23366 eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write CVSS 3.1MEDIUM 5.5
  • TI-2026-40149 eml_parser: DoS via deeply nested parens in Received headers CVSS 3.1HIGH 7.5
  • TI-2026-40147 eml_parser: URL extraction bypass via HTML entities in URLs CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences