Detections
Analytics
CVE-2026-30922
high
Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
References
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-30922.json
https://lists.debian.org/debian-lts-announce/2026/05/msg00001.html
https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r
https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0
https://bugzilla.redhat.com/show_bug.cgi?id=2448553
https://access.redhat.com/security/cve/CVE-2026-30922
https://access.redhat.com/errata/RHSA-2026:8437
https://access.redhat.com/errata/RHSA-2026:6926
https://access.redhat.com/errata/RHSA-2026:6912
https://access.redhat.com/errata/RHSA-2026:6720
https://access.redhat.com/errata/RHSA-2026:6568
https://access.redhat.com/errata/RHSA-2026:6309
https://access.redhat.com/errata/RHSA-2026:41928
https://access.redhat.com/errata/RHSA-2026:37275
https://access.redhat.com/errata/RHSA-2026:24762
https://access.redhat.com/errata/RHSA-2026:24761
https://access.redhat.com/errata/RHSA-2026:22987
https://access.redhat.com/errata/RHSA-2026:22970
https://access.redhat.com/errata/RHSA-2026:22969
https://access.redhat.com/errata/RHSA-2026:22135
https://access.redhat.com/errata/RHSA-2026:22134
https://access.redhat.com/errata/RHSA-2026:22133
https://access.redhat.com/errata/RHSA-2026:22132
https://access.redhat.com/errata/RHSA-2026:22131
https://access.redhat.com/errata/RHSA-2026:20588
https://access.redhat.com/errata/RHSA-2026:19712
https://access.redhat.com/errata/RHSA-2026:19375
https://access.redhat.com/errata/RHSA-2026:19355
https://access.redhat.com/errata/RHSA-2026:19138
https://access.redhat.com/errata/RHSA-2026:17611
https://access.redhat.com/errata/RHSA-2026:17083
https://access.redhat.com/errata/RHSA-2026:16009
https://access.redhat.com/errata/RHSA-2026:14020
https://access.redhat.com/errata/RHSA-2026:13917
https://access.redhat.com/errata/RHSA-2026:13916
https://access.redhat.com/errata/RHSA-2026:13902
https://access.redhat.com/errata/RHSA-2026:13553
https://access.redhat.com/errata/RHSA-2026:13545
https://access.redhat.com/errata/RHSA-2026:13512
https://access.redhat.com/errata/RHSA-2026:13508
https://access.redhat.com/errata/RHSA-2026:12176