CVE-2026-30922 pyasn1 CVE debrief

Who should care

Users of pyasn1 library, especially those using versions prior to 0.6.3, should be aware of this vulnerability and take steps to mitigate it. This includes updating pyasn1 to version 0.6.3 or later, limiting the depth of ASN.1 data decoding, and implementing memory and recursion limits for the decoder. System administrators and security teams responsible for maintaining systems that utilize pyasn1 should prioritize patching and mitigation efforts.

Technical summary

The pyasn1 library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested SEQUENCE (0x30) or SET (0x31) tags with 'Indefinite Length' (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (MAX_OID_ARC_CONTINUATION_OCTETS) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.

Defensive priority

High

Recommended defensive actions

• Update pyasn1 to version 0.6.3 or later
• Limit the depth of ASN.1 data decoding
• Implement memory and recursion limits for the decoder
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-03-18T04:17:18.397Z and was last modified on 2026-07-15T02:19:45.137Z. The NVD entry is currently Modified. This vulnerability affects users of the pyasn1 library, particularly those using versions prior to 0.6.3. The vulnerability allows for a Denial of Service (DoS) attack due to uncontrolled recursion when decoding ASN.1 data with deeply nested structures. Evidence of this vulnerability's impact includes the potential for an attacker to supply a crafted payload that could cause the decoder to crash or consume all available memory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.