CVE-2026-30922: pyasn1 uncontrolled recursion denial of service during decoding

CVE-2026-30922 · Severity: high · CVSS 7.5 · Published 2026-03-18

The pyasn1 library, used for encoding and decoding data in protocols like LDAP, SNMP, and Kerberos, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted, deeply nested data structure that causes the software to crash or exhaust all available system memory. This can lead to service outages for any application relying on this library to process network traffic.

Technologies: Pyasn1, pyasn1 (PyPI). Vendors: Pyasn1, PyPI.

Quick answers

Is CVE-2026-30922 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-30922 being exploited in the wild.
How severe is CVE-2026-30922?
High severity, with a CVSS score of 7.5, published 18 March 2026.
Which products and versions are affected?
Pyasn1 < 0.6.3, <= 0.6.2; pyasn1 (PyPI) ECOSYSTEM:introduced=0,fixed=0.6.3.
Is there a fix for CVE-2026-30922?
Yes. pyasn1 (PyPI): upgrade to 0.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30922 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-30922?
Check whether you run Pyasn1 or pyasn1 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pyasn1 (PyPI): upgrade to 0.6.3 or later
    pip install "pyasn1>=0.6.3"

Technical details

The pyasn1 library's BER/CER/DER decoder fails to track or limit recursion depth when processing nested ASN.1 structures. Specifically, the 'indefLenValueDecoder', 'valueDecoder', and '_decodeComponentsSchemaless' methods recursively invoke the 'decodeFun' callback for every nested component found. By providing a payload with deeply nested SEQUENCE (0x30) or SET (0x31) tags using Indefinite Length (0x80) markers, a remote, unauthenticated attacker can trigger a RecursionError or a MemoryError (OOM) in the Python interpreter. This vulnerability affects services parsing untrusted ASN.1 data, such as X.509 certificates or LDAP queries. The issue is resolved in version 0.6.3.

Affected products

  • pyasn1 pyasn1 <= 0.6.2

Identifiers

  • CVE-2026-30922
  • GHSA-jr27-m4p2-rc6r
  • PYSEC-2026-2263

Timeline

  • 2026-03-17: advisory: GitHub Advisory GHSA-jr27-m4p2-rc6r published
  • 2026-03-17: patched: Version 0.6.3 released
  • 2026-03-18: disclosed: NVD publication of CVE-2026-30922

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.