CVE-2026-44844 in eml_parser
Summary
by MITRE • 05/27/2026
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.1, EmlParser.get_raw_body_text() recurses unconditionally for every nested message/rfc822 attachment without any depth limit. An attacker who can supply a badly crafted EML file with approximately 120 nested message/rfc822 parts triggers an unhandled RecursionError and aborts parsing of the message. A 12 KB EML file is enough to crash a worker. Though this causes the parser to crash, it is an unlikely scenario as the suggested EML that crashes the parser would not pass basic RFC compliance tests. This vulnerability is fixed in 3.0.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/27/2026
The eml_parser python module presents a critical recursion vulnerability that affects versions prior to 3.0.1 through its EmlParser.get_raw_body_text() method. This flaw manifests when processing email files containing nested message/rfc822 attachments, where the parser recursively traverses each nested structure without implementing any depth limitations. The vulnerability stems from the absence of recursion depth controls in the parsing logic, creating an exploitable condition that can be triggered by maliciously crafted email files. The technical implementation lacks proper bounds checking mechanisms that would normally prevent excessive recursive calls, allowing an attacker to craft specifically designed eml files that can cause stack overflow conditions. This represents a classic example of inadequate input validation and recursion control, falling under CWE-674, which addresses uncontrolled recursion in software implementations.
The operational impact of this vulnerability extends beyond simple crash conditions, as it creates a denial of service scenario that can be exploited in worker processes or email processing systems. An attacker requiring only a 12 kilobyte eml file containing approximately 120 nested message/rfc822 parts can trigger an unhandled RecursionError that completely aborts the parsing operation. This vulnerability is particularly concerning in automated email processing environments where workers continuously parse incoming messages, as a single malicious email can cause entire processing pipelines to fail. The crash occurs during the parsing phase, meaning that legitimate email processing is interrupted and potentially all email handling operations in affected systems become unavailable until the worker processes are restarted. The vulnerability demonstrates a fundamental flaw in defensive programming practices where proper exception handling and resource management are missing from the recursive parsing implementation.
The fix implemented in version 3.0.1 addresses this issue by introducing proper recursion depth limiting mechanisms within the EmlParser.get_raw_body_text() method. This mitigation aligns with established security practices for preventing stack overflow conditions and represents a necessary defensive programming approach. The solution involves implementing a maximum recursion depth parameter that prevents the parser from descending beyond a predetermined threshold when processing nested message/rfc822 attachments. This approach follows ATT&CK technique T1499.004, which covers the exploitation of resource consumption vulnerabilities through recursive processing. The implementation of such depth limits is consistent with industry best practices for preventing denial of service attacks through malformed input processing, as recommended in various security frameworks including the OWASP Top Ten and NIST cybersecurity guidelines. Organizations should prioritize updating to version 3.0.1 or later to ensure protection against this specific recursion-based denial of service vulnerability that can be triggered with relatively small malicious email files.