Detections
Analytics

SCA: security update for eml_parser (GHSA-m66c-fw79-6359)

medium Tenable Cloud Security Plugin ID 446278

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - eml_parser serves as a python module for parsing eml files and returning various information found in the
 e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header_fetch_parse
 in eml_parser/parser.py uses email.utils.getaddresses() to parse address-bearing e-mail headers. A deeply
 nested CFWS comment construct exhausts the standard-library recursive descent parser's call stack and
 raises RecursionError, which is not caught and therefore aborts parsing of the entire message. An attacker
 can disrupt SOC pipelines that process untrusted EML files, although callers already need to handle
 exceptions from malformed or pathological messages. This issue is fixed in version 3.0.2. (CVE-2026-55619)

Solution

Update the eml_parser library and its related packages to version 3.0.2 or later.

See Also

https://github.com/advisories/GHSA-m66c-fw79-6359

Plugin Details

Severity: Medium

ID: 446278

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 8/25/2026

Updated: 8/26/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-55619

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/25/2026

Vulnerability Publication Date: 8/25/2026

Reference Information

CVE: CVE-2026-55619