CVE-2026-55620: eml_parser: DoS via deeply nested parens in Received headers
Summary
emlparser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes ~1.3 seconds of CPU saturation per parsed message; runtime quadruples per doubling of nesting depth.
Impact
This represents a CPU exhaustion DoS in any pipeline that processes attacker-supplied EML files. An attacker can create relatively small EML files that will take multiple seconds to parse.
This is particularly problematic for synchronous email-processing pipelines (gateways, sandboxes, real-time triage) where worker latency directly translates to queue backpressure and possible service-level outages.
Patches
Since version 3.0.2, emlparser uses a linear-time algorithm to remove the comments from Received: headers.
Other sources
emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.routing.noparenthesis in emlparser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based fix-point loop whose running time is quadratic in the nesting depth. A single Received: header with 5,000 nested parentheses causes approximately 1.3 seconds of CPU saturation per parsed message, and doubling the nesting depth approximately quadruples the running time. An attacker can submit relatively small EML files that consume multiple seconds of processing time, causing worker latency, queue backpressure, and possible service-level outages in synchronous gateways, sandboxes, and real-time triage pipelines. This issue is fixed in version 3.0.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/eml_parserto a version that resolves this vulnerability.Fixed in 3.0.2 - Upgrade
Upgrade
eml_parserto a version that resolves this vulnerability.Fixed in 3.0.2
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Any pipeline that parses attacker-supplied EML files is exposed. Synchronous email-processing services such as gateways, sandboxes, and real-time triage systems are particularly at risk because parse latency can cause queue backpressure and service-level outages.
What does an attacker need to exploit the issue?
An attacker only needs to provide an EML message with a Received header containing deeply nested parentheses. No privileges or user interaction are required.
What versions should be remediated?
Versions before 3.0.2 should be remediated. Starting with version 3.0.2, eml_parser uses a linear-time algorithm to remove comments from Received headers.
How can I assess whether a message is attempting to trigger the issue?
Inspect Received headers for unusually deep nesting of parenthesized CFWS comments. A header with 5,000 nested parentheses is reported to consume about 1.3 seconds of CPU per parsed message, with runtime quadrupling when nesting depth doubles.