CVE-2026-55620: eml_parser denial of service via nested parentheses in Received headers

CVE-2026-55620 · Severity: high · CVSS 7.5 · Published 2026-08-25

eml_parser is a Python library that parses email files in EML format. The library uses an inefficient algorithm to remove comments from email Received headers, which causes severe CPU exhaustion when processing messages with deeply nested parentheses. An attacker can craft small EML files that consume multiple seconds of processing time per message, starving worker processes and causing service outages in email gateways, sandboxes, and real-time email processing systems.

Technologies: GOVCERT-LU Eml Parser, eml-parser (PyPI). Vendors: GOVCERT-LU, PyPI.

Quick answers

Is CVE-2026-55620 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55620 being exploited in the wild.
How severe is CVE-2026-55620?
High severity, with a CVSS score of 7.5, published 25 August 2026.
Which products and versions are affected?
GOVCERT-LU Eml Parser < 3.0.2; eml-parser (PyPI) ECOSYSTEM:introduced=0,fixed=3.0.2.
Is there a fix for CVE-2026-55620?
Yes. eml-parser (PyPI): upgrade to 3.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55620 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55620?
Check whether you run GOVCERT-LU Eml Parser or eml-parser (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • eml-parser (PyPI): upgrade to 3.0.2 or later
    pip install "eml-parser>=3.0.2"

Technical details

The vulnerability exists in eml_parser's handling of Received headers, which are processed by a regex-based fix-point loop designed to strip CFWS (comments, folding white space) comments enclosed in parentheses. The algorithm has O(n²) time complexity relative to nesting depth due to repeated regex matching on increasingly longer strings. Attack preconditions are minimal: an attacker simply needs to supply a crafted EML file to a system processing email messages—no authentication or special privileges required. The attack is network-reachable for email gateways and services accepting external messages. An attacker can achieve complete denial of service by flooding a queue with maliciously crafted messages, causing synchronous pipelines to stall and reject legitimate traffic. Version 3.0.2 and later replace the regex approach with a linear-time algorithm, eliminating the quadratic behavior.

Affected products

  • GOVCERT-LU eml_parser < 3.0.2

Identifiers

  • CVE-2026-55620
  • GHSA-g7gc-gmgp-wgqg
  • PYSEC-2026-3832

Timeline

  • 2026-06-15: disclosed
  • 2026-08-25: advisory
  • 2026: patched: Version 3.0.2 released with linear-time algorithm

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.