Vulnerability Description
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727
- https://github.com/GOVCERT-LU/eml_parser/pull/90
- https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2
- https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359
FAQ
What is CVE-2026-55619?
CVE-2026-55619 is a vulnerability with a CVSS score of 5.3 (MEDIUM). eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_...
How severe is CVE-2026-55619?
CVE-2026-55619 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55619?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.