eml_parser implements a Python module for parsing EML files. In versions prior to 3.0.1 the method get_raw_body_text() recurses without a depth limit for every nested message/rfc822 attachment. An attacker can supply a crafted EML file containing about 120 nested parts which triggers an unhandled RecursionError and aborts the parsing process. The result is a crash of the worker that processes the file, causing a denial‑of‑service. The weakness is classified as CWE‑674, Uncontrolled Recursion.

The affected product is GOVCERT‑LU eml_parser, any Python installation using a version earlier than 3.0.1. No additional vendors or product versions are listed in the CNA data.

The vulnerability has a CVSS score of 6.3, indicating a moderate impact. No EPSS information is available and it is not listed in CISA KEV. Exploitation requires the ability to supply a malicious EML file to the parser; a 12 KB file with around 120 nested message/rfc822 parts is sufficient to cause a crash. The attack is likely to target automated workers that perform email parsing and is best performed in a context where the attacker controls the input.