CVE-2026-44844: eml_parser DOS Vulnerability

CVE-2026-44844 Overview

CVE-2026-44844 affects eml_parser, a Python module used to parse EML email files and extract structural and computed metadata. Versions prior to 3.0.1 contain an unbounded recursion flaw in the EmlParser.get_raw_body_text() method. The function recurses for every nested message/rfc822 attachment without enforcing a depth limit. A specially crafted EML file with approximately 120 nested message/rfc822 parts triggers an unhandled RecursionError and aborts parsing. A 12 KB EML file is sufficient to crash a parser worker. The vulnerability is classified under CWE-674 (Uncontrolled Recursion).

Critical Impact
A 12 KB malicious EML file can crash any worker process invoking eml_parser versions earlier than 3.0.1, disrupting downstream email analysis pipelines.

Affected Products

eml_parser Python module versions prior to 3.0.1
Email analysis and security pipelines that ingest untrusted EML files using eml_parser
Automated mailbox processing workers built on the affected library

Discovery Timeline

2026-05-26 - CVE-2026-44844 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-44844

Vulnerability Analysis

The vulnerability resides in EmlParser.get_raw_body_text(). The method walks the MIME tree of an EML message and recurses into every embedded message/rfc822 part. The implementation does not track recursion depth and does not enforce a maximum nesting boundary. An attacker who supplies a deeply nested EML structure forces the Python interpreter to exceed its default recursion limit. The result is an unhandled RecursionError that terminates the parsing call and the worker process executing it.

The practical exploitation surface is constrained. An EML file with roughly 120 nested message/rfc822 parts deviates from typical RFC 5322 and RFC 2046 email structure. Standard MTAs and inbound filters reject or normalize such messages before they reach downstream analysis tooling. The flaw is therefore most relevant to systems that ingest raw or unsanitized EML samples, such as threat intelligence pipelines, sandboxes, and forensic analyzers.

Root Cause

The root cause is missing depth tracking in the recursive MIME traversal logic. get_raw_body_text() calls itself for each message/rfc822 child part without a guard clause. Python's default recursion limit is approximately 1000 frames, but the call chain consumes multiple frames per nesting level, so around 120 nested parts is sufficient to exhaust the stack.

Attack Vector

The attack requires the victim system to parse an attacker-supplied EML file. The attacker constructs a message containing approximately 120 layers of nested message/rfc822 attachments. When eml_parser processes the file, the recursive call chain in get_raw_body_text() exceeds the interpreter recursion limit and raises an unhandled RecursionError. The exception propagates and terminates the parsing operation. Repeated submissions can sustain a denial-of-service condition against the parser service. See the GitHub Security Advisory GHSA-g47v-rwmh-r9f8 for vendor details.

Detection Methods for CVE-2026-44844

Indicators of Compromise

EML files containing an unusually high number of nested message/rfc822 MIME parts, typically 100 or more.
RecursionError exceptions appearing in application logs of services that call eml_parser.
Repeated worker crashes or restarts in email parsing or sandbox pipelines correlated with specific inbound messages.

Detection Strategies

Inspect inbound EML files and count message/rfc822 boundaries before invoking the parser; flag files exceeding a reasonable threshold.
Monitor Python application logs for stack traces terminating in RecursionError originating from eml_parser.get_raw_body_text.
Track worker process restart frequency and correlate spikes with recently ingested messages.

Monitoring Recommendations

Emit structured logs around each eml_parser invocation, including source identifier, file size, and parse outcome.
Alert on parser exceptions with severity escalation when the same source repeatedly produces failures.
Retain failed EML samples in quarantine for offline review and signature development.

How to Mitigate CVE-2026-44844

Immediate Actions Required

Upgrade eml_parser to version 3.0.1 or later across all environments that process EML content.
Inventory build manifests, container images, and serverless functions to identify pinned vulnerable versions.
Add file-size and nesting-depth pre-checks in any service that feeds untrusted EML to the parser.

Patch Information

The vulnerability is fixed in eml_parser version 3.0.1. Upgrade via pip install --upgrade eml-parser. Refer to the GitHub Security Advisory GHSA-g47v-rwmh-r9f8 for the maintainer's release notes and patch commit references.

Workarounds

Wrap EmlParser.get_raw_body_text() calls in exception handlers that catch RecursionError and return a controlled error to the caller.
Pre-scan EML files and reject any message containing more than a small, policy-defined number of nested message/rfc822 parts.
Run parsing workers under resource limits and automatic restart supervision to contain crash impact.

bash

# Upgrade to the patched release
pip install --upgrade 'eml-parser>=3.0.1'

# Verify the installed version
python -c "import eml_parser; print(eml_parser.__version__)"