CVE-2026-55619: medium-severity vulnerability in GOVCERT-LU eml_parser
eml_parser: Parser DoS via deeply nested parentheses in e-mail headers
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.5%
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
GOVCERT-LU · eml_parserRelated CVEs — GOVCERT-LU eml_parser
In the same product, most dangerous first.
CVE-2026-55620HIGHeml_parser: DoS via deeply nested parens in Received headersEPSS 0.6%CVE-2026-55618MEDIUMeml_parser: URL extraction bypass via HTML entities in URLsEPSS 0.5%CVE-2026-44844MEDIUMeml_parser: Recursion DoS via nested message/rfc822 attachmentsEPSS 0.4%CVE-2026-29780MEDIUMeml_parser: Path Traversal in Official Example Script Leading to Arbitrary File WriteEPSS 0.3%