DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55620: CVE-2026-55620: Algorithmic Complexity Denial of Service in GOVCERT-LU eml_parser

#security #cve #cybersecurity

CVE-2026-55620: Algorithmic Complexity Denial of Service in GOVCERT-LU eml_parser

Vulnerability ID: CVE-2026-55620
CVSS Score: 7.5
Published: 2026-08-25

Prior to version 3.0.2, GOVCERT-LU's eml_parser library is vulnerable to an algorithmic complexity Denial of Service (DoS) vulnerability via the comment-stripping routine noparenthesis() in routing.py. An unauthenticated attacker can submit a crafted EML file containing nested parenthesized comments to cause complete CPU saturation. This happens due to a quadratic time complexity bottleneck in regex replacement of nested structures.

TL;DR

A quadratic-time regex loop in the comment-stripping parser of eml_parser (< 3.0.2) allows unauthenticated remote attackers to cause complete CPU exhaustion and Denial of Service by sending an EML file with deeply nested parentheses.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network
  • CVSS: 7.5 (High)
  • EPSS: N/A
  • Impact: Denial of Service (CPU Exhaustion)
  • Exploit Status: PoC Available
  • KEV Status: Not Listed

Affected Systems

  • Email Gateways
  • Automated Security Sandboxes
  • SIEM Pipelines
  • Malware Analysis Platforms utilizing eml_parser < 3.0.2
  • eml_parser: < 3.0.2 (Fixed in: 3.0.2)

Code Analysis

Commit: 746a69f

Fix recursion limit, nested parentheses complexity, and HTML entity parsing in URI extraction.

Vulnerable Regex:
- noparenthesis_regex = re.compile(r"""\([^()]*\)""")
- while True:
-     lline = line_
-     line_ = eml_parser.regexes.noparenthesis_regex.sub('', line_)
-     if lline == line_:
-         break

Patched Stack Parser:
+ fragments: list[list[str]] = [[]]
+ for ch in line:
+     if ch == '(':
+         fragments.append([ch])
+     else:
+         fragments[-1].append(ch)
+     if ch == ')' and len(fragments) > 1:
+         fragments.pop()
+ return ''.join(ch for w in fragments for ch in w)
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub Security Advisory: GHSA details regarding the resource exhaustion behavior inside eml_parser when interpreting nested parenthesized comments.

Mitigation Strategies

  • Upgrade eml_parser to version 3.0.2 or higher.
  • Apply operational execution timeouts on parsing routines.
  • Enforce standard SMTP line length limits of 998 characters at the mail transfer agent layer.

Remediation Steps:

  1. Verify the current version of eml_parser using pip show eml_parser.
  2. Run pip install --upgrade eml_parser>=3.0.2 to update the package.
  3. Restart all dependent services, such as mail gateways, sandboxes, or celery worker queues, to apply the patch.

References

Read the full report for CVE-2026-55620 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)