CVE-2026-30922

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
References
Link Resource
https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0 Patch
https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r Exploit Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/03/20/4
https://lists.debian.org/debian-lts-announce/2026/05/msg00001.html
https://access.redhat.com/errata/RHSA-2026:10184
https://access.redhat.com/errata/RHSA-2026:12176
https://access.redhat.com/errata/RHSA-2026:13508
https://access.redhat.com/errata/RHSA-2026:13512
https://access.redhat.com/errata/RHSA-2026:13545
https://access.redhat.com/errata/RHSA-2026:13553
https://access.redhat.com/errata/RHSA-2026:13902
https://access.redhat.com/errata/RHSA-2026:13916
https://access.redhat.com/errata/RHSA-2026:13917
https://access.redhat.com/errata/RHSA-2026:14020
https://access.redhat.com/errata/RHSA-2026:16009
https://access.redhat.com/errata/RHSA-2026:17083
https://access.redhat.com/errata/RHSA-2026:17611
https://access.redhat.com/errata/RHSA-2026:19138
https://access.redhat.com/errata/RHSA-2026:19355
https://access.redhat.com/errata/RHSA-2026:19375
https://access.redhat.com/errata/RHSA-2026:19712
https://access.redhat.com/errata/RHSA-2026:20588
https://access.redhat.com/errata/RHSA-2026:22131
https://access.redhat.com/errata/RHSA-2026:22132
https://access.redhat.com/errata/RHSA-2026:22133
https://access.redhat.com/errata/RHSA-2026:22134
https://access.redhat.com/errata/RHSA-2026:22135
https://access.redhat.com/errata/RHSA-2026:22969
https://access.redhat.com/errata/RHSA-2026:22970
https://access.redhat.com/errata/RHSA-2026:22987
https://access.redhat.com/errata/RHSA-2026:24761
https://access.redhat.com/errata/RHSA-2026:24762
https://access.redhat.com/errata/RHSA-2026:37275
https://access.redhat.com/errata/RHSA-2026:41928
https://access.redhat.com/errata/RHSA-2026:6309
https://access.redhat.com/errata/RHSA-2026:65126
https://access.redhat.com/errata/RHSA-2026:6568
https://access.redhat.com/errata/RHSA-2026:6720
https://access.redhat.com/errata/RHSA-2026:6912
https://access.redhat.com/errata/RHSA-2026:6926
https://access.redhat.com/errata/RHSA-2026:8437
https://access.redhat.com/security/cve/CVE-2026-30922
https://bugzilla.redhat.com/show_bug.cgi?id=2448553
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-30922.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:*

History

No history.

Information

Published : 2026-03-18 04:17

Updated : 2026-09-10 13:18


NVD link : CVE-2026-30922

Mitre link : CVE-2026-30922

CVE.ORG link : CVE-2026-30922


JSON object : View

Products Affected

pyasn1

  • pyasn1
CWE
CWE-674

Uncontrolled Recursion

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')