pyasn1 up to 0.6.2 on Python recursion

Summaryinfo

A vulnerability was found in pyasn1 up to 0.6.2 on Python. It has been classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to recursion. This vulnerability is documented as CVE-2026-30922. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in pyasn1 up to 0.6.2 on Python. This issue affects an unknown code block. The manipulation with an unknown input leads to a recursion vulnerability. Using CWE to declare the problem leads to CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. Impacted is availability. The summary by CVE is:

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-30922 since 03/07/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 302886 (Linux Distros Unpatched Vulnerability : CVE-2026-30922), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.6.3 eliminates this vulnerability. Applying the patch 25ad481c19fdb006e20485ef3fc2e5b3eff30ef0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (302886) and CERT Bund (WID-SEC-2026-0935). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Red Hat Ansible Automation Platform
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Linux
• Oracle Linux
• RESF Rocky Linux
• HCL BigFix
• IBM DB2
• IBM App Connect Enterprise
• Red Hat OpenShift

Productinfo

Name

• pyasn1

Version

• 0.6.0
• 0.6.1
• 0.6.2

License

• open-source

Website

• Product: https://github.com/pyasn1/pyasn1/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion