---
id: CVE-2026-55620
aliases:
  - GHSA-g7gc-gmgp-wgqg
  - PYSEC-2026-3832
title: eml_parser vulnerable to DoS via deeply nested parens in Received headers
summary: eml_parser vulnerable to DoS via deeply nested parens in Received headers
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: eml-parser
product: eml-parser
ecosystem: pip
affected:
  - eml-parser < 3.0.2
patched:
  - eml-parser 3.0.2
published: '2026-08-25'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T12:26:05.568827376Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-g7gc-gmgp-wgqg'
references:
  - url: >-
      https://github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-g7gc-gmgp-wgqg
  - url: 'https://github.com/GOVCERT-LU/eml_parser/pull/90'
  - url: >-
      https://github.com/GOVCERT-LU/eml_parser/commit/746a69f86443eb0b6a47f77db3cfe727c21f92b3
  - url: 'https://github.com/GOVCERT-LU/eml_parser'
  - url: 'https://github.com/GOVCERT-LU/eml_parser/releases/tag/v3.0.2'
  - url: 'https://pypi.org/project/eml-parser'
  - url: 'https://github.com/advisories/GHSA-g7gc-gmgp-wgqg'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55620'
tags:
  - osv
  - pip
  - nvd
  - ghsa
epss: 0.0063
epssPercentile: 0.47954
cwe:
  - CWE-770
  - CWE-1124
ingestedAt: '2026-08-25T18:30:20.999Z'
---

## Overview

### Summary

`eml_parser` strips parenthesised CFWS comments from `Received:` headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single `Received:` header containing 5,000 nested parens causes ~1.3 seconds of CPU saturation per parsed message; runtime quadruples per doubling of nesting depth.

### Impact

This represents a CPU exhaustion DoS in any pipeline that processes attacker-supplied EML files. An attacker can create relatively small EML files that will take multiple seconds to parse.

This is particularly problematic for synchronous email-processing pipelines (gateways, sandboxes, real-time triage) where worker latency directly translates to queue backpressure and possible service-level outages.

### Patches

Since version 3.0.2, `eml_parser` uses a linear-time algorithm to remove the comments from `Received:` headers.

## Affected packages

- `eml-parser < 3.0.2`

## Remediation

Upgrade to a patched release:

- `eml-parser 3.0.2`