CVE-2026-55619 in eml_parser
Summary
by MITRE • 08/25/2026
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The eml_parser library provides a Python interface for extracting and analyzing data from Electronic Mail Message Format (EML) files, which are commonly used by email clients such as Microsoft Outlook to store individual emails. These parsers play a critical role in security operations centers where untrusted or potentially malicious email attachments and messages must be inspected for threats. The specific vulnerability resides within the HeaderParser.header_fetch_parse function located in the eml_parser/parser.py module. This component is responsible for parsing address-bearing headers, such as From, To, Cc, and Bcc fields, by leveraging Python's standard library utility function email.utils.getaddresses to extract sender and recipient information from these header strings.
The technical flaw stems from how the underlying recursive descent parser handles Comment Formatted Word (CFWS) constructs within email addresses. CFWS is a syntactic element defined in RFC 5322 that allows for optional whitespace and comments surrounding atomic parts of an address, such as domain names or local-parts. While standard usage involves minimal nesting, an attacker can craft a pathological EML file containing deeply nested CFWS comment structures. When the email.utils.getaddresses function processes this input, it enters into infinite recursion due to insufficient depth limits on its recursive parsing logic. This uncontrolled recursion rapidly exhausts the Python interpreter's call stack space.
Upon exhausting the available stack memory, the application raises a RecursionError exception. Because the eml_parser library prior to version 3.0.2 does not implement specific exception handling for this error within the header parsing routine, the exception propagates up and causes an abrupt termination of the entire message parsing process. This results in a Denial of Service condition where the parser fails completely rather than gracefully degrading or returning partial data. For security pipelines that rely on continuous processing of high volumes of email traffic to detect phishing, malware, or other threats, this single malformed header can halt the ingestion and analysis of subsequent messages if not properly isolated by upstream error handling mechanisms.
From a classification perspective, this vulnerability aligns with CWE-674, which describes Uncontrolled Recursion in functions that do not limit their depth of recursion. It also relates to CWE-20, Improper Input Validation, as the parser fails to validate or restrict the complexity and nesting level of CFWS constructs before processing them. In terms of offensive security frameworks, this behavior can be leveraged for Denial of Service attacks against email analysis systems, potentially falling under MITRE ATT&CK techniques related to resource exhaustion within application layers. While callers are generally expected to handle exceptions from malformed messages, the lack of inherent protection in the library itself means that any integration point relying on uninterrupted parsing is at risk if proper try-except blocks are not implemented around every call to this specific function.
The operational impact extends beyond simple script failure; it affects the reliability and availability of automated security tools. If a SOC pipeline processes untrusted EML files without robust exception handling, a single crafted email can cause service disruption, leading to gaps in threat visibility. This is particularly dangerous if the parser is part of a larger workflow where subsequent steps depend on successful completion of previous parsing tasks. The issue highlights the importance of defensive coding practices when processing data formats that allow for complex nesting and recursive structures.
This vulnerability was addressed in version 3.0.2 of the eml_parser library, which implements fixes to prevent stack exhaustion from deeply nested CFWS constructs. Users are advised to upgrade immediately to this patched version or later releases. Additionally, organizations should ensure their integration code includes comprehensive exception handling for RecursionError and other parsing failures when processing untrusted email data. Implementing input size limits on header fields and validating the complexity of parsed structures can further mitigate risks associated with malformed inputs in security automation pipelines.