CVE-2026-30922
EUVD-2026-1274718.03.2026, 04:17
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| pyasn1 | pyasn1 | 𝑥 < 0.6.3 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:0.6.3-1.el8ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:4.6.29-2.el8ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:0.6.3-1.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.6.29-2.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:0.6.3-1.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:4.7.12-1.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10 | 0:4.16.0-13.el10_1.4 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10 | 0:4.16.0-21.el10_2.1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:4.16.0-5.el10_0.9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8 | 0:4.2.1-129.el8_10.25 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8 | 0:4.9.0-54.el8_10.33 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | 0:4.2.1-65.el8_4.28 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | 0:4.1.1-90.el8_4.25 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | 0:4.2.1-65.el8_4.28 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | 0:4.1.1-90.el8_4.25 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | 0:4.2.1-89.el8_6.22 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | 0:4.2.1-89.el8_6.22 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | 0:4.9.0-16.el8_6.22 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | 0:4.2.1-89.el8_6.22 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | 0:4.9.0-16.el8_6.22 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | 0:4.2.1-112.el8_8.17 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | 0:4.9.0-40.el8_8.19 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | 0:4.2.1-112.el8_8.17 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | 0:4.9.0-40.el8_8.19 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 0:4.10.0-110.el9_8.2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 0:4.10.0-98.el9_7.13 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | 0:4.10.0-43.el9_2.22 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | 0:4.10.0-62.el9_4.25 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 0:4.10.0-86.el9_6.17 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat AI Inference Server 3.3 | 1778244531 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | 1777398315 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | 1777403872 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | 1777402264 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1777296732 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1777311120 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1777387242 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1774417022 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | 1778677745 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | 1778666124 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Migration Toolkit 1.8 | 1783931722 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1776343111 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778263407 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471672 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471731 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471849 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471734 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471879 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782472374 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471606 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471796 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471661 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471753 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471740 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471834 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471730 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471835 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1782471697 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.1 | 1775169155 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.12 | 1775253092 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.15 | 1775169219 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.16 | 1779204086 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.9 | 1775169218 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Trusted Artifact Signer 1.4 | 1775815407 ≤ 𝑥 < * | ADP |
| Red Hat | Service Telemetry Framework 1.5 | 1777452540 ≤ 𝑥 < * | ADP |
| Red Hat | Service Telemetry Framework 1.5 | 1777407251 ≤ 𝑥 < * | ADP |
| Red Hat | Service Telemetry Framework 1.5 | 1777436150 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| pyasn1 |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| python3-pyasn1 |
| ||||||||||||
| python311-pyasn1 |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| fence-agents-aliyun |
| ||||||||||||||||
| fence-agents-all |
| ||||||||||||||||
| fence-agents-amt-ws |
| ||||||||||||||||
| fence-agents-apc |
| ||||||||||||||||
| fence-agents-apc-snmp |
| ||||||||||||||||
| fence-agents-aws |
| ||||||||||||||||
| fence-agents-azure-arm |
| ||||||||||||||||
| fence-agents-bladecenter |
| ||||||||||||||||
| fence-agents-brocade |
| ||||||||||||||||
| fence-agents-cisco-mds |
| ||||||||||||||||
| fence-agents-cisco-ucs |
| ||||||||||||||||
| fence-agents-common |
| ||||||||||||||||
| fence-agents-compute |
| ||||||||||||||||
| fence-agents-drac5 |
| ||||||||||||||||
| fence-agents-eaton-snmp |
| ||||||||||||||||
| fence-agents-emerson |
| ||||||||||||||||
| fence-agents-eps |
| ||||||||||||||||
| fence-agents-gce |
| ||||||||||||||||
| fence-agents-heuristics-ping |
| ||||||||||||||||
| fence-agents-hpblade |
| ||||||||||||||||
| fence-agents-ibm-powervs |
| ||||||||||||||||
| fence-agents-ibm-vpc |
| ||||||||||||||||
| fence-agents-ibmblade |
| ||||||||||||||||
| fence-agents-ifmib |
| ||||||||||||||||
| fence-agents-ilo-moonshot |
| ||||||||||||||||
| fence-agents-ilo-mp |
| ||||||||||||||||
| fence-agents-ilo-ssh |
| ||||||||||||||||
| fence-agents-ilo2 |
| ||||||||||||||||
| fence-agents-intelmodular |
| ||||||||||||||||
| fence-agents-ipdu |
| ||||||||||||||||
| fence-agents-ipmilan |
| ||||||||||||||||
| fence-agents-kdump |
| ||||||||||||||||
| fence-agents-kubevirt |
| ||||||||||||||||
| fence-agents-lpar |
| ||||||||||||||||
| fence-agents-mpath |
| ||||||||||||||||
| fence-agents-nutanix-ahv |
| ||||||||||||||||
| fence-agents-openstack |
| ||||||||||||||||
| fence-agents-redfish |
| ||||||||||||||||
| fence-agents-rhevm |
| ||||||||||||||||
| fence-agents-rsa |
| ||||||||||||||||
| fence-agents-rsb |
| ||||||||||||||||
| fence-agents-sbd |
| ||||||||||||||||
| fence-agents-scsi |
| ||||||||||||||||
| fence-agents-virsh |
| ||||||||||||||||
| fence-agents-vmware-rest |
| ||||||||||||||||
| fence-agents-vmware-soap |
| ||||||||||||||||
| fence-agents-wti |
| ||||||||||||||||
| fence-agents-zvm |
| ||||||||||||||||
| fence-virt |
| ||||||||||||||||
| fence-virtd |
| ||||||||||||||||
| fence-virtd-cpg |
| ||||||||||||||||
| fence-virtd-libvirt |
| ||||||||||||||||
| fence-virtd-multicast |
| ||||||||||||||||
| fence-virtd-serial |
| ||||||||||||||||
| fence-virtd-tcp |
| ||||||||||||||||
| ha-cloud-support |
| ||||||||||||||||
| resource-agents |
| ||||||||||||||||
| resource-agents-aliyun |
| ||||||||||||||||
| resource-agents-gcp |
| ||||||||||||||||
| resource-agents-paf |
|
Amazon Linux Releases
Amazon Package | |||||
|---|---|---|---|---|---|
| python-pyasn1-doc |
| ||||
| python2-pyasn1 |
| ||||
| python2-pyasn1-modules |
| ||||
| python3-pyasn1 |
| ||||
| python3-pyasn1-modules |
|
Azure Linux Releases
Common Weakness Enumeration
- CWE-674 - Uncontrolled RecursionThe product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References