CVE-2026-55620: eml_parser vulnerable to DoS via deeply nested parens in Received headers
eml_parser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes ~1.3 seconds of CPU saturation per parsed message; runtime quadruples per doubling of nesting depth.
References
- github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3
- github.com/GOVCERT-LU/eml_parser/pull/90
- github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2
- github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-g7gc-gmgp-wgqg
- github.com/advisories/GHSA-g7gc-gmgp-wgqg
- nvd.nist.gov/vuln/detail/CVE-2026-55620
Code Behaviors & Features
Detect and mitigate CVE-2026-55620 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →