AIKIDO-2026-680687

TL;DR

The headeremail2list() function in eml-parser extracts e-mail addresses from headers such as To, From, and Cc by parsing them with the Python standard library address parser. When a header carries an unquoted display name that ends in a bare period, such as Test.<test@example.com>, the standard library parser raises an exception that the library does not catch. The unhandled exception propagates out of the decoding routine and aborts parsing of the entire message, so a single crafted message can disrupt processing in pipelines that ingest untrusted e-mail. The fix wraps the address parsing in exception handling and falls back to regex-based extraction instead of letting the error propagate.