eml_parser: DoS via deeply nested parens in Received headers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.routing.noparenthesis in eml_parser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based fix-point loop whose running time is quadratic in the nesting depth. A single Received: header with 5,000 nested parentheses causes approximately 1.3 seconds of CPU saturation per parsed message, and doubling the nesting depth approximately quadruples the running time. An attacker can submit relatively small EML files that consume multiple seconds of processing time, causing worker latency, queue backpressure, and possible service-level outages in synchronous gateways, sandboxes, and real-time triage pipelines. This issue is fixed in version 3.0.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GOVCERT-LU | eml_parser | before 3.0.2 | 3.0.2 | Patch available | CNA |
| — | eml_parser (PyPI) | before 3.0.2 | 3.0.2 | Patch available | GHSA-g7gc-gmgp-wgqg |
- eml_parser VendorGOVCERT-LU Affected before 3.0.2 Fixed in 3.0.2 Patch available CNA
- eml_parser (PyPI) Vendor— Affected before 3.0.2 Fixed in 3.0.2 Patch available GHSA-g7gc-gmgp-wgqg
Remediation
- Fix · CNA eml_parser (GOVCERT-LU) Fixed in 3.0.2
- Fix · GHSA-g7gc-gmgp-wgqg eml_parser (PyPI) Fixed in 3.0.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55620
- 2026-10-03 Alias added: GHSA-g7gc-gmgp-wgqg
- 2026-10-28 EPSS moved to the 50th–90th percentile
References
Other 5
- https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-g7gc-gmgp-wgqg
- https://github.com/GOVCERT-LU/eml_parser/pull/90
- https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3
- https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2
- https://github.com/GOVCERT-LU/eml_parser
More GOVCERT-LU vulnerabilities
- TI-2026-32722 eml_parser: Recursion DoS via nested message/rfc822 attachments CVSS 4.0MEDIUM 6.3
- TI-2026-23366 eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write CVSS 3.1MEDIUM 5.5
- TI-2026-40148 eml_parser: Parser DoS via deeply nested parentheses in e-mail headers CVSS 3.1MEDIUM 5.3
- TI-2026-40147 eml_parser: URL extraction bypass via HTML entities in URLs CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-55620 · CVE Program
- CVE-2026-55620 · NVD
- FIRST EPSS
- GHSA-g7gc-gmgp-wgqg · GitHub Advisory Database · CC BY 4.0
- CVE-2026-55620 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences