CVE-2026-55620
Received Received - Intake

ReDoS in eml_parser via Nested Parentheses in Received Headers

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.routing.noparenthesis in eml_parser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based fix-point loop whose running time is quadratic in the nesting depth. A single Received: header with 5,000 nested parentheses causes approximately 1.3 seconds of CPU saturation per parsed message, and doubling the nesting depth approximately quadruples the running time. An attacker can submit relatively small EML files that consume multiple seconds of processing time, causing worker latency, queue backpressure, and possible service-level outages in synchronous gateways, sandboxes, and real-time triage pipelines. This issue is fixed in version 3.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55620
EUVD
EUVD-2026-65704

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
govcert-lu eml_parser 3.0.2
govcert-lu eml_parser to 3.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1124 The code contains a callable or other code grouping in which the nesting / branching is too deep.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55620 is a denial-of-service (DoS) vulnerability in the eml_parser library affecting versions prior to 3.0.2. It involves a regex-based loop in eml_parser.routing.noparenthesis that removes parenthesized comments from Received headers in EML files. The loop has quadratic time complexity relative to the depth of nested parentheses, causing excessive CPU usage during parsing.

Detection Guidance

Check the version of eml_parser installed on your system. If it is below 3.0.2, the vulnerability is present. Run: pip show eml_parser or pip list | grep eml_parser to verify the installed version.

Impact Analysis

An attacker can exploit this by submitting EML files with deeply nested parentheses in Received headers. This causes significant CPU saturation during parsing, leading to increased latency, queue backpressure, and potential service outages in synchronous email-processing pipelines like gateways, sandboxes, or real-time triage systems.

Compliance Impact

This vulnerability primarily impacts availability by causing service disruptions through CPU saturation and latency in email-processing systems. While it does not directly affect confidentiality or integrity, prolonged outages could lead to non-compliance with regulations like GDPR (timely data processing) or HIPAA (service availability for protected health information).

Mitigation Strategies

Upgrade eml_parser to version 3.0.2 or later immediately. Use: pip install --upgrade eml_parser. If upgrading is not possible, consider disabling parsing of Received headers or implementing rate limiting for EML file processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55620. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart