The eml_parser Python module versions before 3.0.1 contain an uncontrolled recursion vulnerability (CWE-674) in the get_raw_body_text() method. This method recursively processes nested message/rfc822 parts without limiting recursion depth. A specially crafted EML file with approximately 120 nested message/rfc822 parts can cause a RecursionError, crashing the parser. The vulnerability is due to the lack of recursion depth control, leading to a denial of service condition when parsing such malformed EML files. The vulnerability is addressed in eml_parser version 3.0.1.

Successful exploitation causes the eml_parser to crash due to an unhandled RecursionError, resulting in denial of service during EML file parsing. The crafted EML file needed to trigger this condition is relatively small (~12 KB) but unlikely to pass basic RFC compliance checks, reducing the likelihood of exploitation. There is no indication of code execution or data leakage. No known exploits have been reported in the wild.

Upgrade eml_parser to version 3.0.1 or later, where this uncontrolled recursion vulnerability is fixed. Since the vendor advisory confirms the fix in 3.0.1, applying this official update is the recommended remediation. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.