The eml_parser module before version 3.0.1 contains an uncontrolled recursion vulnerability (CWE-674) in the get_raw_body_text() method. This method recursively processes nested message/rfc822 parts without limiting recursion depth. A maliciously crafted EML file with approximately 120 nested message/rfc822 attachments can cause a RecursionError, aborting the parsing process. The vulnerability can be triggered by a relatively small (12 KB) EML file. However, the required EML structure is unlikely to be encountered in normal or RFC-compliant email traffic. The vulnerability has a CVSS 4.0 base score of 6.3 (medium severity).

Successful exploitation causes the eml_parser to crash due to an unhandled RecursionError, resulting in denial of service for the parsing operation. There is no indication of code execution or data compromise. The attack requires a specially crafted EML file that is not RFC compliant, reducing the likelihood of exploitation in typical environments.

This vulnerability is fixed in eml_parser version 3.0.1. Users should upgrade to version 3.0.1 or later to remediate this issue. No other mitigation or workaround is indicated. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 3.0.1, which should be considered the official fix.