GOVCERT-LU eml_parser up to 3.0.1 Received Header Processing eml_parser/routing.py eml_parser.routing.noparenthesis redos

Summaryinfo

A vulnerability identified as problematic has been detected in GOVCERT-LU eml_parser up to 3.0.1. This issue affects the function eml_parser.routing.noparenthesis of the file eml_parser/routing.py of the component Received Header Processing. The manipulation leads to redos. This vulnerability is documented as CVE-2026-55620. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in GOVCERT-LU eml_parser up to 3.0.1. This issue affects the function eml_parser.routing.noparenthesis of the file eml_parser/routing.py of the component Received Header Processing. The manipulation with an unknown input leads to a redos vulnerability. Using CWE to declare the problem leads to CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Impacted is availability. The summary by CVE is:

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.routing.noparenthesis in eml_parser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based fix-point loop whose running time is quadratic in the nesting depth. A single Received: header with 5,000 nested parentheses causes approximately 1.3 seconds of CPU saturation per parsed message, and doubling the nesting depth approximately quadruples the running time. An attacker can submit relatively small EML files that consume multiple seconds of processing time, causing worker latency, queue backpressure, and possible service-level outages in synchronous gateways, sandboxes, and real-time triage pipelines. This issue is fixed in version 3.0.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-55620 since 06/17/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1449.003 for this issue.

Upgrading to version 3.0.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• GOVCERT-LU

Name

• eml_parser

Version

• 3.0.0
• 3.0.1

Website

• Product: https://github.com/GOVCERT-LU/eml_parser/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion