CVE-2026-55620

A flaw was found in emlparser, a Python module designed for parsing email files. A remote attacker can exploit a vulnerability in how the module processes Received: headers containing deeply nested parentheses. By submitting specially crafted email files, an attacker can cause excessive CPU usage...

CVE-2026-55620

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.routing.noparenthesis in emlparser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based...

GHSA-G7GC-GMGP-WGQG eml_parser vulnerable to DoS via deeply nested parens in Received headers

Summary emlparser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes 1.3 seconds of CPU saturation per parsed message;...

CVE-2026-55620

eml_parser is a Python module for parsing EML files. Prior to 3.0.2 , the eml_parser.routing.noparenthesis function in eml_parser/routing.py removes parenthesized CFWS comments from Received: headers using a regex-based fix-point loop with quadratic running time in nesting depth. A single Receive...

CVE-2026-55620 eml_parser: DoS via deeply nested parens in Received headers

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.routing.noparenthesis in emlparser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based...

CVE-2026-55620 eml_parser: DoS via deeply nested parens in Received headers

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.routing.noparenthesis in emlparser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based...

GHSA-M66C-FW79-6359 eml_parser has parser DoS via deeply nested parentheses in e-mail headers

Summary emlparser uses the email.utils.getaddresses function from the CPython standard library to parse e-mail headers that contain e-mail addresses such as To, Cc, Bcc, From, Reply-To, Sender, .... When the input header contains a deeply nested CFWS comment / folding white space construct, the...

EUVD-2026-65703

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.parser.HeaderParser.headerfetchparse in emlparser/parser.py uses email.utils.getaddresses to parse address-bearing e-mail...

PT-2026-81476

Name of the Vulnerable Software and Affected Versions eml parser versions prior to 3.0.2 Description The noparenthesis function in eml parser/routing.py uses a regex-based fix-point loop to remove parenthesized CFWS Comments and Folding White Space from Received: headers. The processing time for...

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

Summary sqlparse ships hard limits MAXGROUPINGDEPTH=100, MAXGROUPINGTOKENS=10000 intended to bound parsing work on attacker-supplied SQL, but the path that reaches those limits is itself Ondepth per token-group construction. A 1-2 KB SQL payload e.g. SELECT 1 ... with 500-2000 nesting levels, or ...

CVE-2026-67194

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser allocsearchkey in searchinfo.C recursively descends on nested parenthesized groups through a mutual...

Kanidm 安全漏洞

Kanidm is a simple and secure identity management platform developed by Kanidm itself. Versions of Kanidm prior to 1.9.3 contained security vulnerabilities. These vulnerabilities were caused by the recursive descent PEG parser in SCIM endpoints, which led to a stack overflow when processing neste...

CLSA-2026-1778022490 dovecot: Fix of CVE-2026-27857

CVE-2026-27857: limit number of open IMAP parser lists in imap-login to prevent excessive memory usage DoS via deeply-nested parentheses...

CLSA-2026-1777977059 dovecot: Fix of CVE-2026-27857

CVE-2026-27857: limit the number of open IMAP parser lists in imap-login to prevent excessive memory usage from deeply nested parentheses e.g. NOOP...

CLSA-2026-1777976700 dovecot: Fix of CVE-2026-27857

CVE-2026-27857: limit the number of open IMAP parser lists in imap-login to prevent excessive memory usage from deeply nested parentheses e.g. NOOP...

📄 Dovecot IMAP NOOP Command Memory Exhaustion Denial of Service

This Metasploit auxiliary module targets a memory exhaustion vulnerability in the Dovecot IMAP service. It opens multiple concurrent TCP connections and sends specially crafted NOOP commands containing deeply nested parentheses to force excessive memory allocation on the server. By sustaining the...

xgrammar vulnerable to DoS via multi-layer nesting

Summary The multi-level nested syntax caused a segmentation fault core dump. Details A trigger stack overflow or memory exhaustion was caused by constructing a malicious grammar rule containing 30,000 layers of nested parentheses. PoC !/usr/bin/env python3 """ XGrammar - Math Expression Generatio...

SUSE CVE-2009-1885

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service application crash via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrat...

SUSE CVE-2016-3191

The compilebranch function in pcrecompile.c in PCRE 8.x before 8.39 and pcre2compile.c in PCRE2 before 10.22 mishandles patterns containing an ACCEPT substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service stack-based...

Moderate: Red Hat Security Advisory: dbus security update

An update for dbus is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...