CVE-2026-30922 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
Attackers can crash applications using pyasn1 by sending deeply nested ASN.1 data, causing uncontrolled recursion and resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30922?
CVE-2026-30922 is a high-severity denial of service vulnerability in pyasn1, published on 18 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
Which versions are affected by CVE-2026-30922?
3 open source packages ship an affected version, including pyasn1. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyasn1 PyPI | All versions | 0.6.3 |
pyasn1 PyPI | All versions | 0.6.3 |
pyasn1 PyPI | All versions | 0.6.3 |
Linux distribution packages (37)
resource-agents AlmaLinux:8 | All versions | 4.9.0-54.el8_10.33 |
resource-agents-aliyun AlmaLinux:8 | All versions | 4.9.0-54.el8_10.33 |
resource-agents-gcp AlmaLinux:8 | All versions | 4.9.0-54.el8_10.33 |
resource-agents-paf AlmaLinux:8 | All versions | 4.9.0-54.el8_10.33 |
fence-agents-aliyun AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-all AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-amt-ws AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-apc AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-apc-snmp AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-aws AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-azure-arm AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-bladecenter AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-brocade AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-cisco-mds AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-cisco-ucs AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-common AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-compute AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-drac5 AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-eaton-snmp AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-emerson AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-eps AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-gce AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-heuristics-ping AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-hpblade AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-ibm-powervs AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-ibm-vpc AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-ibmblade AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-ifmib AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-ilo-moonshot AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-ilo-mp AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-ilo-ssh AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-ilo2 AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-intelmodular AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-ipdu AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-ipmilan AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-kdump AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
fence-agents-kubevirt AlmaLinux:9 | All versions | 4.10.0-98.el9_7.13 |
Products include Pyasn1 Pyasn1.
How do I fix CVE-2026-30922?
Upgrade pyasn1 to 0.6.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-30922 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30922 exists.
Other vulnerabilities in pyasn1
- CVE-2026-59884 pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
- CVE-2026-59885 pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
- CVE-2026-59886 pyasn1: Uncontrolled resource consumption when converting decoded REAL values
Sources
Also known as ALSA-2026:13902, ALSA-2026:13917, AZL-80238, BELL-CVE-2026-30922, CLEANSTART-2026-BW26261, CLEANSTART-2026-HQ36260 and 47 more.