CVE-2026-55619

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3
https://github.com/GOVCERT-LU/eml_parser/pull/90
https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2
https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-25 19:16

Updated : 2026-09-09 21:07

NVD link : CVE-2026-55619

Mitre link : CVE-2026-55619

CVE.ORG link : CVE-2026-55619

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

CWE-1124

Excessively Deep Nesting

{"id": "CVE-2026-55619", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55619", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T19:18:55.505319Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "GOVCERT-LU", "product": "eml_parser", "versions": [{"status": "affected", "version": "< 3.0.2"}]}]}], "published": "2026-08-25T19:16:50.477", "references": [{"url": "https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3", "source": "security-advisories@github.com"}, {"url": "https://github.com/GOVCERT-LU/eml_parser/pull/90", "source": "security-advisories@github.com"}, {"url": "https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}, {"lang": "en", "value": "CWE-1124"}]}], "descriptions": [{"lang": "en", "value": "eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2."}], "lastModified": "2026-09-09T21:07:31.353", "sourceIdentifier": "security-advisories@github.com"}