Vulnerability · Published Mar 18, 2026 · Assigned by GitHub_M

CVE-2026-30922pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

High 7.5

In plain English

A high-severity infinite loop in pyasn1 from pyasn1. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 42.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8fence-agents-aliyun4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-aliyun4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8fence-agents-all4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-all4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-amt-ws4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-amt-ws4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-amt-ws4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-apc4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-apc4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-apc4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-apc-snmp4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-apc-snmp4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-apc-snmp4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8fence-agents-aws4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-aws4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8fence-agents-azure-arm4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-azure-arm4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-bladecenter4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-bladecenter4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-bladecenter4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-brocade4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-brocade4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-brocade4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-cisco-mds4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-cisco-mds4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-cisco-mds4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-cisco-ucs4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-cisco-ucs4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-cisco-ucs4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8fence-agents-common4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-common4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8fence-agents-compute4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-compute4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-drac54.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-drac54.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-drac54.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-eaton-snmp4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-eaton-snmp4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-eaton-snmp4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-emerson4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-emerson4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-emerson4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-eps4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-eps4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-eps4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8fence-agents-gce4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-gce4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-heuristics-ping4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-heuristics-ping4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-heuristics-ping4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-hpblade4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-hpblade4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-hpblade4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-ibm-powervs4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-ibm-powervs4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-ibm-powervs4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-ibm-vpc4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-ibm-vpc4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-ibm-vpc4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-ibmblade4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-ibmblade4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-ibmblade4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-ifmib4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-ifmib4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-ifmib4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-ilo-moonshot4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-ilo-moonshot4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-ilo-moonshot4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-ilo-mp4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-ilo-mp4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-ilo-mp4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-ilo-ssh4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-ilo-ssh4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-ilo-ssh4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-ilo24.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-ilo24.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-ilo24.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-intelmodular4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-intelmodular4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-intelmodular4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-ipdu4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-ipdu4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-ipdu4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-ipmilan4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-ipmilan4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-ipmilan4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8fence-agents-kdump4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-kdump4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8fence-agents-kubevirt4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-kubevirt4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-lpar4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-lpar4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-lpar4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-mpath4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-mpath4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-mpath4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-nutanix-ahv4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-nutanix-ahv4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-nutanix-ahv4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8fence-agents-openstack4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-openstack4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8fence-agents-redfish4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-redfish4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-rhevm4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-rhevm4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-rhevm4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-rsa4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-rsa4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-rsa4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-rsb4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-rsb4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-rsb4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-sbd4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-sbd4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-sbd4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-scsi4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-scsi4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-scsi4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-virsh4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-virsh4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-virsh4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-vmware-rest4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-vmware-rest4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-vmware-rest4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-vmware-soap4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-vmware-soap4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-vmware-soap4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:10fence-agents-wti4.16.0-13.el10_1.4ALSA-2026:13916
AlmaLinux:8fence-agents-wti4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-wti4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8fence-agents-zvm4.2.1-129.el8_10.25ALSA-2026:12176
AlmaLinux:9fence-agents-zvm4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:9fence-virt4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:9fence-virtd4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:9fence-virtd-cpg4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:9fence-virtd-libvirt4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:9fence-virtd-multicast4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:9fence-virtd-serial4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:9fence-virtd-tcp4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:9ha-cloud-support4.10.0-98.el9_7.13ALSA-2026:13917
AlmaLinux:8resource-agents4.9.0-54.el8_10.33ALSA-2026:13902
AlmaLinux:8resource-agents-aliyun4.9.0-54.el8_10.33ALSA-2026:13902
AlmaLinux:8resource-agents-gcp4.9.0-54.el8_10.33ALSA-2026:13902
AlmaLinux:8resource-agents-paf4.9.0-54.el8_10.33ALSA-2026:13902
Debian:12pyasn10.4.8-3+deb12u2DEBIAN-CVE-2026-30922
Debian:13pyasn10.6.1-1+deb13u2DEBIAN-CVE-2026-30922
Debian:14pyasn10.6.3-1DEBIAN-CVE-2026-30922
PyPIpyasn10.6.3GHSA-jr27-m4p2-rc6r
PyPIpyasn10.6.3PYSEC-2026-2263
Rocky Linux:10fence-agents0:4.16.0-13.el10_1.4RLSA-2026:13916
Rocky Linux:10fence-agents0:4.16.0-21.el10_2.1RLSA-2026:19138
Rocky Linux:8fence-agents0:4.2.1-129.el8_10.25RLSA-2026:12176
Rocky Linux:9fence-agents0:4.10.0-110.el9_8.2RLSA-2026:19355
Rocky Linux:9fence-agents0:4.10.0-98.el9_7.13RLSA-2026:13917
Rocky Linux:8resource-agents0:4.9.0-54.el8_10.33RLSA-2026:13902
Ubuntu:22.04:LTSpyasn10.4.8-1ubuntu0.2UBUNTU-CVE-2026-30922
Ubuntu:24.04:LTSpyasn10.4.8-4ubuntu0.2UBUNTU-CVE-2026-30922
Ubuntu:25.10pyasn10.6.1-1ubuntu0.2UBUNTU-CVE-2026-30922

Affected products (as reported)

VendorProductVersions
pyasn1 pyasn1 < 0.6.3

Weakness: CWE-674, CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References