Vulnerability-Lookup

CVE-2026-55619 (GCVE-0-2026-55619)

Vulnerability from cvelistv5 – Published: 2026-08-25 18:24 – Updated: 2026-08-25 19:20

Title

eml_parser: Parser DoS via deeply nested parentheses in e-mail headers

Summary

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 19:18 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling
CWE-1124 - Excessively Deep Nesting

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/GOVCERT-LU/eml_parser/security…	x_refsource_CONFIRM
https://github.com/GOVCERT-LU/eml_parser/pull/90	x_refsource_MISC
https://github.com/GOVCERT-LU/eml_parser/commit/7…	x_refsource_MISC
https://github.com/GOVCERT-LU/eml_parser/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
GOVCERT-LU	eml_parser	Affected: < 3.0.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55619",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T19:18:55.505319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T19:20:15.362Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "eml_parser",
          "vendor": "GOVCERT-LU",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser\u0027s call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1124",
              "description": "CWE-1124: Excessively Deep Nesting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T18:24:29.921Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359"
        },
        {
          "name": "https://github.com/GOVCERT-LU/eml_parser/pull/90",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/GOVCERT-LU/eml_parser/pull/90"
        },
        {
          "name": "https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3"
        },
        {
          "name": "https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-m66c-fw79-6359",
        "discovery": "UNKNOWN"
      },
      "title": "eml_parser: Parser DoS via deeply nested parentheses in e-mail headers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55619",
    "datePublished": "2026-08-25T18:24:29.921Z",
    "dateReserved": "2026-06-16T23:31:22.446Z",
    "dateUpdated": "2026-08-25T19:20:15.362Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55619",
      "date": "2026-08-27",
      "epss": "0.00302",
      "percentile": "0.22263"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55619\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-25T19:16:50.477\",\"lastModified\":\"2026-08-25T20:16:57.673\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser\u0027s call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"GOVCERT-LU\",\"product\":\"eml_parser\",\"versions\":[{\"version\":\"\u003c 3.0.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-25T19:18:55.505319Z\",\"id\":\"CVE-2026-55619\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"},{\"lang\":\"en\",\"value\":\"CWE-1124\"}]}],\"references\":[{\"url\":\"https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/GOVCERT-LU/eml_parser/pull/90\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-08-26T12:03:12+00:00",
      "cve": "CVE-2026-55619",
      "id": "CVE-2026-55619",
      "initial_release_date": "2026-08-25T18:24:29.921000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "eml_parser: eml_parser: Denial of Service vulnerability in email header parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55619.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55619\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-25T19:18:55.505319Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-25T19:19:02.650Z\"}}], \"cna\": {\"title\": \"eml_parser: Parser DoS via deeply nested parentheses in e-mail headers\", \"source\": {\"advisory\": \"GHSA-m66c-fw79-6359\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"GOVCERT-LU\", \"product\": \"eml_parser\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.0.2\"}]}], \"references\": [{\"url\": \"https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359\", \"name\": \"https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/GOVCERT-LU/eml_parser/pull/90\", \"name\": \"https://github.com/GOVCERT-LU/eml_parser/pull/90\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3\", \"name\": \"https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2\", \"name\": \"https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser\u0027s call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770: Allocation of Resources Without Limits or Throttling\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1124\", \"description\": \"CWE-1124: Excessively Deep Nesting\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-25T18:24:29.921Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-55619\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-25T19:20:15.362Z\", \"dateReserved\": \"2026-06-16T23:31:22.446Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-25T18:24:29.921Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55619

Vulnerability from fkie_nvd - Published: 2026-08-25 19:16 - Updated: 2026-08-25 20:16

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3
	security-advisories@github.com	https://github.com/GOVCERT-LU/eml_parser/pull/90
	security-advisories@github.com	https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2
	security-advisories@github.com	https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "eml_parser",
          "vendor": "GOVCERT-LU",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser\u0027s call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2."
    }
  ],
  "id": "CVE-2026-55619",
  "lastModified": "2026-08-25T20:16:57.673",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55619",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T19:18:55.505319Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-25T19:16:50.477",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/GOVCERT-LU/eml_parser/pull/90"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        },
        {
          "lang": "en",
          "value": "CWE-1124"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-M66C-FW79-6359

Vulnerability from github – Published: 2026-08-25 18:25 – Updated: 2026-08-25 18:25

Summary

eml_parser has parser DoS via deeply nested parentheses in e-mail headers

Details

Summary

eml_parser uses the email.utils.getaddresses() function from the CPython standard library to parse e-mail headers that contain e-mail addresses (such as To, Cc, Bcc, From, Reply-To, Sender, ...). When the input header contains a deeply nested CFWS (comment / folding white space) construct, the recursive descent parser in the standard library exhausts the call stack. The resulting RecursionError is not caught by eml_parser, so the exception propagates and aborts parsing of the whole message.

Impact

SOC pipelines use eml_parser to process untrusted e-mails. An attacker can easily create an eml file that will trigger the RecursionError during parsing.

The impact is mitigated by the fact that there are various other situations in which eml_parser will raise an exception when attempting to parse a malformed or pathological eml file. In particular, very deeply nested multipart e-mails also result in a RecursionError being raised by the library voluntarily. Therefore, systems relying on eml_parser already need to detect and handle errors emanating from the library in an appropriate way.

Workarounds

The issue can be avoided by wrapping the call to eml_parser.decode_email or eml_parser.decode_email_bytes in a try/except construct.

Patches

Since version 3.0.2, eml_parser will catch the error in the standard library parser and fall back to a simpler parser based on a regular expression.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "eml_parser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55619"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1124",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T18:25:47Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`eml_parser` uses the `email.utils.getaddresses()` function from the CPython standard library to parse e-mail headers that contain e-mail addresses (such as `To`, `Cc`, `Bcc`, `From`, `Reply-To`, `Sender`, ...). When the input header contains a deeply nested CFWS (comment / folding white space) construct, the recursive descent parser in the standard library exhausts the call stack. The resulting `RecursionError` is not caught by `eml_parser`, so the exception propagates and aborts parsing of the whole message.\n\n### Impact\n\nSOC pipelines use `eml_parser` to process untrusted e-mails. An attacker can easily create an eml file that will trigger the `RecursionError` during parsing.\n\nThe impact is mitigated by the fact that there are various other situations in which `eml_parser` will raise an exception when attempting to parse a malformed or pathological eml file. In particular, very deeply nested multipart e-mails also result in a `RecursionError` being raised by the library voluntarily. Therefore, systems relying on `eml_parser` already need to detect and handle errors emanating from the library in an appropriate way.\n\n### Workarounds\n\nThe issue can be avoided by wrapping the call to `eml_parser.decode_email` or `eml_parser.decode_email_bytes` in a `try/except` construct.\n\n### Patches\n\nSince version 3.0.2, `eml_parser` will catch the error in the standard library parser and fall back to a simpler parser based on a regular expression.",
  "id": "GHSA-m66c-fw79-6359",
  "modified": "2026-08-25T18:25:47Z",
  "published": "2026-08-25T18:25:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-m66c-fw79-6359"
    },
    {
      "type": "WEB",
      "url": "https://github.com/GOVCERT-LU/eml_parser/pull/90"
    },
    {
      "type": "WEB",
      "url": "https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/GOVCERT-LU/eml_parser"
    },
    {
      "type": "WEB",
      "url": "https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "eml_parser has parser DoS via deeply nested parentheses in e-mail headers"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-55619 (GCVE-0-2026-55619)

FKIE_CVE-2026-55619

GHSA-M66C-FW79-6359

Summary

Impact

Workarounds

Patches

Tags

Sightings

Nomenclature