eml_parser is a Python module that parses EML files and reports metadata. In versions prior to 3.0.2 the function that removes parenthesized comments from Received headers uses a regex‑based fix‑point loop whose execution time rises quadratically with the nesting depth of parentheses. An attacker can create an EML file containing a single Received header with thousands of nested parentheses. Parsing such a message consumes several seconds of CPU time, inducing latency for the worker, back‑pressure on queues, and possibly service disruption for email gateways, sandboxes, or triage pipelines. The weakness is an example of CWE‑1124 and CWE‑770.

The affected product is the eml_parser Python module provided by GOVCERT‑LU. All releases prior to 3.0.2 are vulnerable, including v3.0.1 and earlier. Version 3.0.2, released on GitHub, includes a fix that removes the vulnerable loop and restricts the processing of Received headers.

The CVSS score for this vulnerability is 7.5, reflecting a high impact Denial of Service when the exploit is successful. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker sending a crafted EML file to any application that parses it using this module. No authentication or elevated privileges are required; a single file can trigger the DoS. Exploitation is straightforward because the faulty parsing code is executed automatically on every message that contains a Received header.