The vulnerability originates from a recursive descent parser invoked by eml_parser.parser.HeaderParser.header_fetch_parse. When an e‑mail header contains a deeply nested CFWS comment construct, the standard‑library parser exhausts its call stack and throws a RecursionError that is not handled, causing the entire message parsing to abort. The result is a denial of ability to process legitimate or innocuous EML files, potentially crippling downstream security operations or data ingestion pipelines. The weakness is a classic input validation failure (CWE‑1124) combined with a stack overflow condition (CWE‑770).

The flaw affects the GOVCERT‑LU eml_parser package in all releases older than v3.0.2. Version 3.0.2 and later include a fix that sanitizes or guards against the recursive descent recursion exception. No other products are directly impacted by this issue.

The CVSS score of 5.3 classifies the flaw as medium severity due to its limited scope and need to supply a crafted EML file. EPSS is not available, but the lack of a publicly available exploit and the requirement for a malformed input suggest a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. An attacker can trigger the denial of service by sending maliciously crafted e‑mail messages containing nested parentheses or CFWS comments to any system that parses EML files using this library. Proper exception handling or the availability of the patched library mitigates the risk.