CVE-2026-30922 Details
Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
A denial-of-service vulnerability has been identified in the pyasn1 library, prior to version 0.6.3. The issue arises from uncontrolled recursion when the library decodes ASN.1 data with deeply nested structures. An attacker can exploit this vulnerability by sending a crafted payload that includes thousands of nested SEQUENCE (0x30) or SET (0x31) tags marked with 'Indefinite Length' (0x80) indicators. This manipulation causes the decoder to recursively process the data until the Python interpreter either crashes due to a RecursionError or runs out of memory, leading to an application crash. This vulnerability is separate from a previously addressed integer overflow issue in OID decoding, and the fix for that problem does not resolve the current recursion-related vulnerability.
Users can upgrade to pyasn1 version 0.6.3, which addresses this vulnerability by introducing a maximum nesting depth limit in the decoder.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| pyasn1 pyasn1 | < 0.6.3 |
CPE
Remediation
| |
Change History
23 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | redhat-SADP |
| Sep 9, 2026 | CVE Modified | redhat-SADP |
| Sep 7, 2026 | CVE Modified | redhat-SADP |
| Sep 2, 2026 | CVE Modified | redhat-SADP |
| Sep 2, 2026 | CVE Modified | CVE |
| Sep 2, 2026 | CVE Modified | [email protected] |
| Aug 24, 2026 | CVE Modified | redhat-SADP |
| Aug 19, 2026 | CVE Modified | redhat-SADP |
| Aug 18, 2026 | CVE Modified | redhat-SADP |
| Aug 12, 2026 | CVE Modified | redhat-SADP |
| Aug 5, 2026 | CVE Modified | redhat-SADP |
| Aug 4, 2026 | CVE Modified | redhat-SADP |
| Aug 3, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 17, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 1, 2026 | CVE Modified | CVE |
| Mar 21, 2026 | CVE Modified | CVE |
| Mar 20, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |