PYSEC-2026-3832

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/eml-parser/PYSEC-2026-3832.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-3832
Aliases
Published
2026-09-10T09:44:56Z
Modified
2026-09-10T12:15:03Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
eml_parser vulnerable to DoS via deeply nested parens in Received headers
Details

Summary

eml_parser strips parenthesised CFWS comments from Received: headers using a regex-based fix-point loop. The loop has quadratic time complexity in the number of nested parens. A single Received: header containing 5,000 nested parens causes ~1.3 seconds of CPU saturation per parsed message; runtime quadruples per doubling of nesting depth.

Impact

This represents a CPU exhaustion DoS in any pipeline that processes attacker-supplied EML files. An attacker can create relatively small EML files that will take multiple seconds to parse.

This is particularly problematic for synchronous email-processing pipelines (gateways, sandboxes, real-time triage) where worker latency directly translates to queue backpressure and possible service-level outages.

Patches

Since version 3.0.2, eml_parser uses a linear-time algorithm to remove the comments from Received: headers.

References

Affected packages

PyPI / eml-parser

Package

Name
eml-parser
View open source insights on deps.dev
Purl
pkg:pypi/eml-parser

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.2

Affected versions

0.*
0.9
1.*
1.0
1.1
1.3
1.4
1.5
1.6
1.7
1.8
1.9
1.10
1.11
1.11.1
1.11.2
1.11.4
1.11.5
1.11.6
1.11.7
1.12.0
1.13.0
1.14.0
1.14.1
1.14.2
1.14.3
1.14.4
1.14.5
1.14.6
1.14.7
1.14.8
1.15.0
1.16.0
1.17.0
1.17.1
1.17.2
1.17.3
1.17.4
1.17.5
2.*
2.0.0
2.0.1
3.*
3.0.0
3.0.1

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/eml-parser/PYSEC-2026-3832.yaml"