Resource exhaustion in Govcert-Lu Eml Parser
CVE-2026-55619
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.005 (42.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 42.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.002
Affected products
- Govcert-Lu Eml Parser — versions < 3.0.2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-55619?
- CVE-2026-55619 is a medium-severity vulnerability in Govcert-Lu Eml Parser, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2026-08-25.
- How severe is CVE-2026-55619?
- Medium severity. CVSS v3 base score is 5.3 out of 10.