GHSA-g7gc-gmgp-wgqg

Source

https://github.com/advisories/GHSA-g7gc-gmgp-wgqg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-g7gc-gmgp-wgqg/GHSA-g7gc-gmgp-wgqg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g7gc-gmgp-wgqg

Aliases

Published

2026-08-25T18:27:18Z

Modified

2026-09-10T12:26:05Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

eml_parser vulnerable to DoS via deeply nested parens in Received headers

Details

Summary

eml_parser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes ~1.3 seconds of CPU saturation per parsed message; runtime quadruples per doubling of nesting depth.

Impact

This represents a CPU exhaustion DoS in any pipeline that processes attacker-supplied EML files. An attacker can create relatively small EML files that will take multiple seconds to parse.

This is particularly problematic for synchronous email-processing pipelines (gateways, sandboxes, real-time triage) where worker latency directly translates to queue backpressure and possible service-level outages.

Patches

Since version 3.0.2, eml_parser uses a linear-time algorithm to remove the comments from Received: headers.

Database specific

{
    "cwe_ids":  [
        "CWE-1124",
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-25T18:27:18Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

PyPI / eml-parser

Package

Name: eml-parser; View open source insights on deps.dev
Purl: pkg:pypi/eml-parser

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.0.2

Affected versions

0.*

0.9

1.*

1.0

1.1

1.3

1.4

1.5

1.6

1.7

1.8

1.9

1.10

1.11

1.11.1

1.11.2

1.11.4

1.11.5

1.11.6

1.11.7

1.12.0

1.13.0

1.14.0

1.14.1

1.14.2

1.14.3

1.14.4

1.14.5

1.14.6

1.14.7

1.14.8

1.15.0

1.16.0

1.17.0

1.17.1

1.17.2

1.17.3

1.17.4

1.17.5

2.*

2.0.0

2.0.1

3.*

3.0.0

3.0.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-g7gc-gmgp-wgqg/GHSA-g7gc-gmgp-wgqg.json"