CVE-2026-55619: eml_parser DOS Vulnerability

CVE-2026-55619 Overview

CVE-2026-55619 is a denial-of-service vulnerability in eml_parser, a Python module used to parse .eml files and extract metadata from e-mail messages. Versions prior to 3.0.2 fail to catch RecursionError exceptions raised by the Python standard library when parsing address headers containing deeply nested Comment/Folded White Space (CFWS) constructs. An attacker who supplies a crafted EML file can abort parsing of the entire message, disrupting Security Operations Center (SOC) pipelines that ingest untrusted mail. The issue is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling] and fixed in version 3.0.2.

Critical Impact
Malformed EML input triggers an uncaught RecursionError in email.utils.getaddresses(), halting downstream analysis of e-mail messages processed by SOC automation.

Affected Products

eml_parser Python module, all versions prior to 3.0.2
SOC automation pipelines and phishing triage tooling that ingest untrusted EML files via eml_parser
Downstream applications embedding eml_parser.parser.HeaderParser.header_fetch_parse

Discovery Timeline

2026-08-25 - CVE-2026-55619 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55619

Vulnerability Analysis

The defect lives in eml_parser/parser.py, specifically HeaderParser.header_fetch_parse, which delegates address-header parsing to email.utils.getaddresses() in the Python standard library. That function uses a recursive descent parser to decode CFWS comment constructs permitted by RFC 5322. When comment nesting depth grows large enough to exhaust the interpreter's call stack, Python raises RecursionError. eml_parser did not catch this exception, so the error propagated up and aborted parsing of the whole message rather than the single offending header.

The practical outcome is a parser abort on any well-formed message that includes a pathological header. Callers processing bulk mail lose visibility into that message, and any workflow depending on structured header output stops mid-pipeline.

Root Cause

The root cause is missing exception handling around a recursive third-party parser [CWE-770]. header_fetch_parse invoked super().header_fetch_parse(name, value) without bounding recursion or catching RecursionError. Any adversary able to place attacker-controlled bytes into To, From, Cc, Bcc, Reply-To, Sender, or their Resent-* variants can control comment nesting depth and induce the failure.

Attack Vector

The attack requires no authentication and no user interaction beyond delivering a malicious .eml file to a service that parses it. Typical delivery paths include phishing-analysis mailboxes, mail archives ingested by SIEM connectors, and forensic pipelines that unpack EML attachments. The impact is limited to availability of the parsing step; there is no confidentiality or integrity loss.

python

# Patch applied in eml_parser/parser.py (v3.0.2)
elif header in ('sender', 'resent-sender', 'to', 'resent-to', 'cc', 'resent-cc', 'bcc', 'resent-bcc', 'from', 'resent-from', 'reply-to'):
    try:
        return super().header_fetch_parse(name, value)
    except RecursionError:
        # This can happen when the recursion gets too deep in in the stdlib recursive descent parser.
        # In this case, the header is certainly pathological. We still try to extract some addresses.
        m = eml_parser.regexes.email_regex.findall(value)
        return ', '.join(m)

return super().header_fetch_parse(name, value)

Source: GitHub Commit 746a69f

Detection Methods for CVE-2026-55619

Indicators of Compromise

EML files whose address headers (To, From, Cc, Bcc, Reply-To, Sender, Resent-*) contain deeply nested parenthesised CFWS comments such as (((((((...))))))).
Python tracebacks in application logs terminating in RecursionError originating from email.utils.getaddresses or email._parseaddr.
Sudden gaps or unparsed message counts in mail-ingestion metrics coinciding with delivery of external EML samples.

Detection Strategies

Add structured logging around HeaderParser.header_fetch_parse calls and alert on RecursionError exceptions caught by application-level handlers.
Statically inspect inbound EML samples for header lines exceeding a reasonable parenthesis-nesting threshold before handing them to the parser.
Track parser exit codes and processing latency per message; abnormal aborts on small inputs indicate pathological content.

Monitoring Recommendations

Instrument the mail-ingestion service with counters for parse successes, parse failures, and exception types, and forward them to a SIEM or data lake.
Retain the raw EML sample and hash when a parse failure occurs to enable retrospective hunting for related campaigns.
Correlate parse failures with sender reputation and delivery source to distinguish accidental malformation from targeted abuse.

How to Mitigate CVE-2026-55619

Immediate Actions Required

Upgrade eml_parser to version 3.0.2 or later across all environments that ingest untrusted EML input.
Audit dependency manifests (requirements.txt, pyproject.toml, Pipfile.lock) for pinned versions below 3.0.2 and rebuild affected container images.
Wrap existing eml_parser calls in defensive try/except blocks that catch RecursionError and Exception so a single malformed message cannot abort a batch.

Patch Information

The fix is released as eml_parser v3.0.2 via Pull Request #90 and detailed in GHSA-m66c-fw79-6359. The patched header_fetch_parse catches RecursionError for address-bearing headers and falls back to a regex-based e-mail extraction using eml_parser.regexes.email_regex, preserving partial data instead of aborting the message.

Workarounds

If upgrading is not immediately possible, monkey-patch HeaderParser.header_fetch_parse in the calling application to wrap the super() call in a try/except RecursionError block that falls back to regex extraction.
Raise the Python recursion limit only as a temporary buffer using sys.setrecursionlimit, understanding that it does not eliminate the underlying issue and may increase memory pressure.
Pre-filter inbound EML samples and reject or quarantine any header lines whose opening-parenthesis count exceeds a documented threshold.

bash

# Upgrade to the fixed release
pip install --upgrade 'eml_parser>=3.0.2'

# Verify installed version
python -c "import eml_parser; print(eml_parser.__version__)"