Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| eml_parser | pip | < 3.0.2 | 3.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-55619, describes a Denial of Service (DoS) in the eml_parser module caused by deeply nested parentheses in e-mail headers. Specifically, it states that eml_parser.parser.HeaderParser.header_fetch_parse uses email.utils.getaddresses() which, when faced with a deeply nested CFWS comment, exhausts the standard-library recursive descent parser's call stack and raises a RecursionError. This error was not caught, leading to the abortion of the entire message parsing.
Analysis of the provided commit 746a69f86443eb0b6a47f77db3cfe727c21f92b3 confirms this:
eml_parser/parser.py - HeaderParser.header_fetch_parse: The patch introduces a try-except RecursionError block around the call to super().header_fetch_parse for specific address-bearing headers. This directly addresses the unhandled RecursionError described in the CVE. Before this patch, the RecursionError would propagate, causing the DoS. Therefore, eml_parser.parser.HeaderParser.header_fetch_parse is identified as a vulnerable function because it failed to handle this critical exception.
eml_parser/routing.py - noparenthesis: The commit also significantly refactors the noparenthesis function. The original implementation, which relied on a while True loop with re.sub, was inefficient and could lead to performance degradation and resource exhaustion when processing inputs with deeply nested parentheses. The commit message explicitly mentions 'fix slow parenthesis removal'. While not directly causing the RecursionError in email.utils.getaddresses(), this function's inefficiency contributes to the overall vulnerability of the parser to pathological inputs involving parentheses, making it a secondary but related vulnerable component.
Both identified functions, eml_parser.parser.HeaderParser.header_fetch_parse and eml_parser.routing.noparenthesis, were modified to address issues stemming from the processing of malformed or pathological email headers containing deeply nested parentheses, which could lead to resource exhaustion and denial of service.
eml_parser.parser.HeaderParser.header_fetch_parseeml_parser/parser.py
eml_parser.routing.noparenthesiseml_parser/routing.py