{"api_version":"1","generated_at":"2026-08-30T22:40:24+00:00","cve":"CVE-2026-55619","urls":{"html":"https://cve.report/CVE-2026-55619","api":"https://cve.report/api/cve/CVE-2026-55619.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-55619","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-55619"},"summary":{"title":"eml_parser: Parser DoS via deeply nested parentheses in e-mail headers","description":"eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-08-25 19:16:50","updated_at":"2026-08-25 20:16:57"},"problem_types":["CWE-770","CWE-1124","CWE-770 CWE-770: Allocation of Resources Without Limits or Throttling","CWE-1124 CWE-1124: Excessively Deep Nesting"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"references":[{"url":"https://github.com/GOVCERT-LU/eml_parser/pull/90","name":"https://github.com/GOVCERT-LU/eml_parser/pull/90","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3","name":"https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2","name":"https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359","name":"https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55619","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55619","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"GOVCERT-LU","product":"eml_parser","version":"affected < 3.0.2","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"55619","cve":"CVE-2026-55619","epss":"0.003020000","percentile":"0.222610000","score_date":"2026-08-26","updated_at":"2026-08-27 00:10:21"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-55619","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-08-25T19:18:55.505319Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-25T19:20:15.362Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"eml_parser","vendor":"GOVCERT-LU","versions":[{"status":"affected","version":"< 3.0.2"}]}],"descriptions":[{"lang":"en","value":"eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-770","description":"CWE-770: Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-1124","description":"CWE-1124: Excessively Deep Nesting","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-25T18:24:29.921Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359","tags":["x_refsource_CONFIRM"],"url":"https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359"},{"name":"https://github.com/GOVCERT-LU/eml_parser/pull/90","tags":["x_refsource_MISC"],"url":"https://github.com/GOVCERT-LU/eml_parser/pull/90"},{"name":"https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3","tags":["x_refsource_MISC"],"url":"https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3"},{"name":"https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2","tags":["x_refsource_MISC"],"url":"https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2"}],"source":{"advisory":"GHSA-m66c-fw79-6359","discovery":"UNKNOWN"},"title":"eml_parser: Parser DoS via deeply nested parentheses in e-mail headers"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-55619","datePublished":"2026-08-25T18:24:29.921Z","dateReserved":"2026-06-16T23:31:22.446Z","dateUpdated":"2026-08-25T19:20:15.362Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-25 19:16:50","lastModifiedDate":"2026-08-25 20:16:57","problem_types":["CWE-770","CWE-1124","CWE-770 CWE-770: Allocation of Resources Without Limits or Throttling","CWE-1124 CWE-1124: Excessively Deep Nesting"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-25T19:18:55.505319Z","id":"CVE-2026-55619","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"55619","Ordinal":"1","Title":"eml_parser: Parser DoS via deeply nested parentheses in e-mail h","CVE":"CVE-2026-55619","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"55619","Ordinal":"1","NoteData":"eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.","Type":"Description","Title":"eml_parser: Parser DoS via deeply nested parentheses in e-mail h"}]}}}