CVE-2026-30922
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
The pyasn1 library prior to version 0.6.3 is vulnerable to a Denial of Service (DoS) attack due to uncontrolled recursion when decoding deeply nested ASN.1 structures. An attacker can craft a payload with thousands of nested SEQUENCE or SET tags with Indefinite Length markers, causing a stack overflow or memory exhaustion.
Risk Assessment
The risk is that an unauthenticated attacker can remotely crash any application using pyasn1 by sending a specially crafted ASN.1 packet, leading to service disruption (DoS).
Recommendation
Immediately upgrade pyasn1 to version 0.6.3 or later, which includes a fix for the uncontrolled recursion vulnerability.
Other vulnerabilities in pyasn1
See all- CVE-2026-59886High
In pyasn1 prior to 0.6.4, the univ.Real type converts its mantissa, base, and exponent to a Python float using exact big-integer exponentiation. A short BER/CER/DER encoded REAL value can carry a very large exponent, causing excessive CPU and memory consumption and application hangs when prettyPrint(), str(), comparison, arithmetic, int(), or explicit float() is called on untrusted ASN.1 data.
- CVE-2026-59885High
The pyasn1 library before version 0.6.4 has a quadratic time complexity in BER, CER, and DER decoders when processing OBJECT IDENTIFIER and RELATIVE-OID values with many arcs. A small crafted payload with many OID arcs causes excessive CPU consumption per decode() call, potentially leading to denial of service in applications processing untrusted ASN.1 data.
- CVE-2026-59884High
The pyasn1 library before version 0.6.4 has a vulnerability in the BER decoder that does not limit the tag ID size when parsing long-form tags, allowing crafted input to force construction of an arbitrarily large integer with quadratic CPU cost and trigger unhandled ValueError exceptions in Python 3.11+.
- CVE-2026-23490High
The pyasn1 library before version 0.6.2 is vulnerable to a Denial-of-Service attack causing memory exhaustion via malformed RELATIVE-OID with excessive continuation octets.
Original NVD description (English source)
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.