Performance and Processing Issues in eml_parser Python Module by GOVCERT-LU

CVE-2026-55620

What is CVE-2026-55620?

The eml_parser module has a vulnerability related to the processing of Received: headers. The regex-based fix-point loop used to remove parenthesized comments can lead to significant CPU resource consumption, especially with deeply nested parentheses. For instance, a header with just 5,000 nested parentheses results in approximately 1.3 seconds of CPU time for parsing. As the nesting depth increases, the processing time grows exponentially, creating potential denial of service conditions. Attackers can exploit this by submitting EML files engineered to trigger delays, leading to worker latency and possible service-level outages. This flaw has been addressed in version 3.0.2.

References