CVE-2026-55620: CWE-770: Allocation of Resources Without Limits or Throttling in GOVCERT-LU eml_parser

The eml_parser Python module used for parsing EML files contains a resource exhaustion vulnerability (CWE-770) due to a regex-based fix-point loop in eml_parser.routing.noparenthesis that removes parenthesized CFWS comments from Received: headers. This loop's runtime grows quadratically with the nesting depth of parentheses. For example, a Received: header with 5,000 nested parentheses causes about 1.3 seconds of CPU saturation per message, and doubling the nesting depth quadruples processing time. This can be exploited by attackers submitting small but computationally expensive EML files, causing worker latency, queue backpressure, and potential service outages in real-time email processing pipelines. The vulnerability is fixed in eml_parser version 3.0.2.

The vulnerability leads to denial of service conditions by consuming excessive CPU resources during email parsing. This can cause increased latency, queue backpressure, and possible outages in synchronous gateways, sandboxes, and real-time triage pipelines that rely on eml_parser. There is no impact on confidentiality or integrity reported. No known exploits are currently in the wild.

Upgrade eml_parser to version 3.0.2 or later, where this issue is fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly confirmed by a vendor advisory, but the fix is stated to be in version 3.0.2.