CVE-2026-55619: eml_parser has parser DoS via deeply nested parentheses in e-mail headers
eml_parser uses the email.utils.getaddresses() function from the CPython standard library to parse e-mail headers that contain e-mail addresses (such as To, Cc, Bcc, From, Reply-To, Sender, …). When the input header contains a deeply nested CFWS (comment / folding white space) construct, the recursive descent parser in the standard library exhausts the call stack. The resulting RecursionError is not caught by eml_parser, so the exception propagates and aborts parsing of the whole message.
References
- github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3
- github.com/GOVCERT-LU/eml_parser/pull/90
- github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2
- github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359
- github.com/advisories/GHSA-m66c-fw79-6359
- nvd.nist.gov/vuln/detail/CVE-2026-55619
Code Behaviors & Features
Detect and mitigate CVE-2026-55619 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →