Govcert Lu
Monthly
CPU exhaustion denial-of-service in eml_parser (Python pip package, versions prior to 3.0.2) stems from a quadratic-time regex fix-point loop in the `noparenthesis` function used to strip parenthesized CFWS comments from `Received:` email headers. Remote, unauthenticated attackers can submit small, specially crafted EML files containing deeply nested parentheses that consume multiple seconds of CPU time per parsed message, degrading throughput and causing queue backpressure or service-level outages in synchronous email gateways, sandboxes, and real-time triage pipelines. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from first principles using only the published advisory description.
Denial of service in GOVCERT-LU's eml_parser Python library (versions prior to 3.0.2) allows a network-reachable attacker to abort SOC pipeline email parsing by submitting a crafted EML file containing deeply nested CFWS (Comment/Folding White Space) constructs in address-bearing headers such as To, From, Cc, or Bcc. The RecursionError raised internally by Python's email.utils.getaddresses() propagates uncaught through eml_parser, halting analysis of the entire message rather than just the offending header. No public exploit or active exploitation has been identified at time of analysis; the vendor notes partial mitigation because callers already need to handle exceptions from other pathological EML inputs.
URL extraction bypass in GOVCERT-LU eml_parser prior to version 3.0.2 allows a remote sender to craft phishing emails containing HTML-entity-encoded URLs that evade the library's URL extraction entirely. Security gateways and SOC pipelines relying on eml_parser to produce IOC lists will silently omit these obfuscated links, preventing submission to threat-intelligence feeds, URL reputation services, and sandboxes. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the regression test added in the fix commit provides a clear reproduction template.
Unsanitized attachment filenames in eml_parser prior to version 2.0.1 enable path traversal attacks, allowing attackers to write files outside the intended output directory when the example extraction script processes malicious emails. Organizations using the vulnerable example code or similar attachment handling logic are at risk of unauthorized file writes that could overwrite critical files or introduce malicious content. Public exploit code exists for this vulnerability, and a patch is available in version 2.0.1 and later.
CPU exhaustion denial-of-service in eml_parser (Python pip package, versions prior to 3.0.2) stems from a quadratic-time regex fix-point loop in the `noparenthesis` function used to strip parenthesized CFWS comments from `Received:` email headers. Remote, unauthenticated attackers can submit small, specially crafted EML files containing deeply nested parentheses that consume multiple seconds of CPU time per parsed message, degrading throughput and causing queue backpressure or service-level outages in synchronous email gateways, sandboxes, and real-time triage pipelines. No public exploit has been identified at time of analysis, but the attack is trivially reproducible from first principles using only the published advisory description.
Denial of service in GOVCERT-LU's eml_parser Python library (versions prior to 3.0.2) allows a network-reachable attacker to abort SOC pipeline email parsing by submitting a crafted EML file containing deeply nested CFWS (Comment/Folding White Space) constructs in address-bearing headers such as To, From, Cc, or Bcc. The RecursionError raised internally by Python's email.utils.getaddresses() propagates uncaught through eml_parser, halting analysis of the entire message rather than just the offending header. No public exploit or active exploitation has been identified at time of analysis; the vendor notes partial mitigation because callers already need to handle exceptions from other pathological EML inputs.
URL extraction bypass in GOVCERT-LU eml_parser prior to version 3.0.2 allows a remote sender to craft phishing emails containing HTML-entity-encoded URLs that evade the library's URL extraction entirely. Security gateways and SOC pipelines relying on eml_parser to produce IOC lists will silently omit these obfuscated links, preventing submission to threat-intelligence feeds, URL reputation services, and sandboxes. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the regression test added in the fix commit provides a clear reproduction template.
Unsanitized attachment filenames in eml_parser prior to version 2.0.1 enable path traversal attacks, allowing attackers to write files outside the intended output directory when the example extraction script processes malicious emails. Organizations using the vulnerable example code or similar attachment handling logic are at risk of unauthorized file writes that could overwrite critical files or introduce malicious content. Public exploit code exists for this vulnerability, and a patch is available in version 2.0.1 and later.