CyberRota Analysis
AI-GeneratedThe eml_parser Python module is vulnerable to a denial-of-service condition due to a flaw in the header parsing function, which can be exploited by deeply nested comments in email headers, leading to a RecursionError that halts message processing. This vulnerability primarily impacts systems that rely on the module to handle untrusted EML files, potentially disrupting security operations center (SOC) workflows. Organizations using versions prior to 3.0.2 should prioritize updating to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2.