DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55619: CVE-2026-55619: Parser Denial of Service via Deeply Nested Parentheses in E-mail Headers

#security #cve #cybersecurity

CVE-2026-55619: Parser Denial of Service via Deeply Nested Parentheses in E-mail Headers

Vulnerability ID: CVE-2026-55619
CVSS Score: 5.3
Published: 2026-08-25

A denial of service vulnerability in GOVCERT-LU eml_parser before version 3.0.2 allows unauthenticated remote attackers to trigger an unhandled RecursionError exception. The issue arises during the parsing of structured email headers containing excessively nested parentheses representing Comments and Folding White Space (CFWS). Because the parser fails to catch this recursion-limit exception from Python's standard library, processing of the entire mail immediately aborts, which can disrupt automated security triage pipelines and email ingestion components.

TL;DR

An unhandled RecursionError in the address-parsing routines of eml_parser (< 3.0.2) allows unauthenticated remote attackers to crash email ingestion pipelines by submitting crafted email headers with deeply nested parentheses.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770 / CWE-1124
  • Attack Vector: Network
  • CVSS: 5.3
  • Impact: Denial of Service
  • Exploit Status: PoC available
  • KEV Status: Not Listed

Affected Systems

  • GOVCERT-LU eml_parser
  • eml_parser: < 3.0.2 (Fixed in: 3.0.2)

Code Analysis

Commit: 746a69f

Fix RecursionError when parsing pathological address-bearing email headers with highly nested parentheses and refactor noparenthesis parsing to O(N)

@@ -105,6 +105,15 @@ def header_fetch_parse(self, name: str, value: str) -> str:

             return eml_parser.decode.robust_string2date(value).isoformat()

+        elif header in ('sender', 'resent-sender', 'to', 'resent-to', 'cc', 'resent-cc', 'bcc', 'resent-bcc', 'from', 'resent-from', 'reply-to'):
+            try:
+                return super().header_fetch_parse(name, value)
+            except RecursionError:
+                # This can happen when the recursion gets too deep in in the stdlib recursive descent parser.
+                # In this case, the header is certainly pathological. We still try to extract some addresses.
+                m = eml_parser.regexes.email_regex.findall(value)
+                return ', '.join(m)
+
         return super().header_fetch_parse(name, value)
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GHSA-m66c-fw79-6359 Test Suite: Integration and unit tests verifying the crash behavior on address headers containing nested parenthetical structures.

Mitigation Strategies

  • Upgrade to eml_parser version 3.0.2 or higher
  • Implement application-level try-except blocks to catch RecursionError during parsing
  • Filter highly nested or repetitive parenthesis patterns at the mail gateway boundary

Remediation Steps:

  1. Execute pip install --upgrade eml-parser>=3.0.2 in affected environments
  2. Verify system logs to ensure unhandled stack traces are eliminated
  3. Establish quarantine folders for emails failing RFC 5322 structure validation

References

Read the full report for CVE-2026-55619 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)