Executive brief
eml_parser is a Python library that parses email files in EML format. The library uses an inefficient algorithm to remove comments from email Received headers, which causes severe CPU exhaustion when processing messages with deeply nested parentheses. An attacker can craft small EML files that consume multiple seconds of processing time per message, starving worker processes and causing service outages in email gateways, sandboxes, and real-time email processing systems.
Technical details
The vulnerability exists in eml_parser's handling of Received headers, which are processed by a regex-based fix-point loop designed to strip CFWS (comments, folding white space) comments enclosed in parentheses. The algorithm has O(n²) time complexity relative to nesting depth due to repeated regex matching on increasingly longer strings. Attack preconditions are minimal: an attacker simply needs to supply a crafted EML file to a system processing email messages—no authentication or special privileges required. The attack is network-reachable for email gateways and services accepting external messages. An attacker can achieve complete denial of service by flooding a queue with maliciously crafted messages, causing synchronous pipelines to stall and reject legitimate traffic. Version 3.0.2 and later replace the regex approach with a linear-time algorithm, eliminating the quadratic behavior.
Affected products
- GOVCERT-LU eml_parser < 3.0.2
Timeline
- 2026-06-15: disclosed
- 2026-08-25: advisory
- 2026: patched: Version 3.0.2 released with linear-time algorithm