CVE-2026-44844: GOVCERT-LU eml_parser uncontrolled recursion in get_raw_body_text

Executive brief

A vulnerability in the eml_parser library, which is used to process email files, can allow an attacker to crash the software. By sending a specially crafted email with many layers of nested attachments, an attacker can cause the system to stop responding or restart. This can disrupt email processing pipelines and lead to a denial of service for organizations relying on this tool.

Technical details

The EmlParser.get_raw_body_text() function in eml_parser/parser.py fails to implement a recursion depth limit when processing nested 'message/rfc822' attachments. An attacker can provide a crafted EML file (approximately 12 KB) with roughly 120 nested levels to exhaust CPython's default recursion limit, triggering an unhandled RecursionError. This crash propagates out of decode_email_bytes(), aborting the entire parsing process. The vulnerability is exploitable via the network without authentication in systems that ingest external emails. A fix is available in version 3.0.1 which implements recursion depth checks.

Affected products

• GOVCERT-LU eml_parser <= 3.0.0

Timeline

• 2026-05-05: disclosed: Vulnerability reported to GOVCERT-LU/eml_parser
• 2026-05-08: advisory: GitHub Advisory GHSA-g47v-rwmh-r9f8 published
• 2026-05-26: other: NVD published CVE-2026-44844
• 2026-06-08: other: Advisory last updated

References

• https://api.github.com/users/Sebasteuo
• https://github.com/Sebasteuo
• https://api.github.com/users/Sebasteuo/gists%7B/gist_id%7D
• https://api.github.com/users/Sebasteuo/repos
• https://avatars.githubusercontent.com/u/37353257?v=4
• https://api.github.com/users/Sebasteuo/events%7B/privacy%7D