Excessively Deep Nesting

Overview eml-parser is a Python EML parser library Affected versions of this package are vulnerable to Excessively Deep Nesting through the processing of deeply nested parentheses in Received headers. An attacker can cause excessive CPU consumption by submitting specially crafted EML files with a...

axa-fr-splitter (>=0.0.2, <=0.1.2), cyvoreos (>=0.2.0.3b0, <=0.2.0.7b0) +4 more potentially affected by CVE-2026-55620 via eml-parser (>=1.17.5, <=2.0.1)

eml-parser PYPI version =1.17.5, =0.0.2, =0.2.0.3b0, =1.0.7, =1.1.1b0, =0.1.13, =0.0.99.dev0, =0.0.125.dev0 Source cves: CVE-2026-55620 Source advisory: MEND:CVE-2026-55620...

Excessively Deep Nesting

Overview eml-parser is a Python EML parser library Affected versions of this package are vulnerable to Excessively Deep Nesting in the parsing process of e-mail headers containing deeply nested parentheses. An attacker can cause the application to exhaust the call stack and terminate unexpectedly...

axa-fr-splitter (>=0.0.2, <=0.1.2), cyvoreos (>=0.2.0.3b0, <=0.2.0.7b0) +4 more potentially affected by CVE-2026-55619 via eml-parser (>=1.17.5, <=2.0.1)

eml-parser PYPI version =1.17.5, =0.0.2, =0.2.0.3b0, =1.0.7, =1.1.1b0, =0.1.13, =0.0.99.dev0, =0.0.125.dev0 Source cves: CVE-2026-55619 Source advisory: MEND:CVE-2026-55619...

Improper Encoding or Escaping of Output

Overview eml-parser is a Python EML parser library Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the URL extraction process. An attacker can cause valid URLs containing HTML entities to be omitted from extraction by encoding characters such as :, /...

axa-fr-splitter (>=0.0.2, <=0.1.2), cyvoreos (>=0.2.0.3b0, <=0.2.0.7b0) +4 more potentially affected by CVE-2026-55618 via eml-parser (>=1.17.5, <=2.0.1)

eml-parser PYPI version =1.17.5, =0.0.2, =0.2.0.3b0, =1.0.7, =1.1.1b0, =0.1.13, =0.0.99.dev0, =0.0.125.dev0 Source cves: CVE-2026-55618 Source advisory: MEND:CVE-2026-55618...

PT-2026-81474

Name of the Vulnerable Software and Affected Versions eml parser versions prior to 3.0.2 Description The clean found uri function in eml parser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash, or period characters. This causes valid encoded URLs and...

PT-2026-81996

Summary eml parser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML...

PT-2026-81476

Name of the Vulnerable Software and Affected Versions eml parser versions prior to 3.0.2 Description The noparenthesis function in eml parser/routing.py uses a regex-based fix-point loop to remove parenthesized CFWS Comments and Folding White Space from Received: headers. The processing time for...

PT-2026-82002

Summary eml parser uses the email.utils.getaddresses function from the CPython standard library to parse e-mail headers that contain e-mail addresses such as To, Cc, Bcc, From, Reply-To, Sender, .... When the input header contains a deeply nested CFWS comment / folding white space construct, the...

PT-2026-81475

Name of the Vulnerable Software and Affected Versions eml parser versions prior to 3.0.2 Description The header fetch parse function within the eml parser.parser.HeaderParser module uses email.utils.getaddresses to parse address-bearing e-mail headers. A deeply nested CFWS Comments and Folding...

PT-2026-81997

Summary eml parser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes 1.3 seconds of CPU saturation per parsed message;...

eml_parser has recursion DoS via nested message/rfc822 attachments

SummaryEmlParser.getrawbodytext recurses unconditionally for every nested message/rfc822 attachment without any depth limit. An attacker who can supply a badly crafted EML file with approximately 120 nested message/rfc822 parts triggers an unhandled RecursionError and aborts parsing of the messag...

PYSEC-2026-2468 eml_parser has recursion DoS via nested message/rfc822 attachments

Summary EmlParser.getrawbodytext recurses unconditionally for every nested message/rfc822 attachment without any depth limit. An attacker who can supply a badly crafted EML file with approximately 120 nested message/rfc822 parts triggers an unhandled RecursionError and aborts parsing of the...

EUVD-2026-31977

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.1, EmlParser.getrawbodytext recurses unconditionally for every nested message/rfc822 attachment without any depth limit. An attacker who ca...

axa-fr-splitter (>=0.0.2, <=0.1.2), cyvoreos (>=0.2.0.3b0, <=0.2.0.7b0) +4 more potentially affected by CVE-2026-44844 via eml-parser (>=1.17.5, <=2.0.1)

eml-parser PYPI version =1.17.5, =0.0.2, =0.2.0.3b0, =1.0.7, =1.1.1b0, =0.1.13, =0.0.99.dev0, =0.0.125.dev0 Source cves: CVE-2026-44844 Source advisory: MEND:CVE-2026-44844...

CVE-2026-44844

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.1, EmlParser.getrawbodytext recurses unconditionally for every nested message/rfc822 attachment without any depth limit. An attacker who ca...

CVE-2026-44844 eml_parser: Recursion DoS via nested message/rfc822 attachments

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.1, EmlParser.getrawbodytext recurses unconditionally for every nested message/rfc822 attachment without any depth limit. An attacker who ca...

EMLParser security vulnerability

EmlParser is an open-source Python library for parsing email files, developed by GOVCERT.LU. Versions of EmlParser prior to 3.0.1 contained security vulnerabilities. These vulnerabilities stemmed from the use of EmlParser.getrawbodytext, which performed unrestricted recursive processing on nested...

Uncontrolled Recursion

Overview eml-parser is a Python EML parser library Affected versions of this package are vulnerable to Uncontrolled Recursion through the getrawbodytext function. An attacker can cause the application to crash by supplying an email file with deeply nested message/rfc822 attachments, leading to...