Threats Tagged 'cve-2026-55620'

CVE-2026-55620 is a high-severity vulnerability in the GOVCERT-LU eml_parser Python module prior to version 3.0.2. The flaw involves a regex-based fix-point loop in the function eml_parser.routing.noparenthesis that removes parenthesized comments from Received: headers. This loop has quadratic time complexity relative to the nesting depth of parentheses, causing excessive CPU consumption when processing emails with deeply nested parentheses. An attacker can exploit this by submitting crafted EML files with deeply nested parentheses, leading to significant processing delays and potential denial of service in synchronous email processing systems. The issue is fixed in version 3.0.2. No official patch advisory or exploit reports are currently available.