7.5
High
CVE-2026-30922 pyasn1 is a generic ASN.1 library for Python
Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| pyasn1 0.6 | earliest → < 0.6.3 | 0.6.3 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | Versions not published | |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | Versions not published |
Show the 37 other branches Hide the 37 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | Versions not published | |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | Versions not published | |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | Versions not published | |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published | |
| Red Hat AI Inference Server 3.3 1778244531 | earliest → < 1778244531 | 1778244531 |
| Red Hat Ansible Automation Platform 2.5 1777402264 | earliest → < 1777402264 | 1777402264 |
| Red Hat Ansible Automation Platform 2.6 1774417022 | earliest → < 1774417022 | 1774417022 |
| Red Hat Enterprise Linux AI 3.3 1778666124 | earliest → < 1778666124 | 1778666124 |
| Red Hat OpenShift AI 2.25 1788185899 | earliest → < 1788185899 | 1788185899 |
| Red Hat OpenShift AI 3.3 1782471697 | earliest → < 1782471697 | 1782471697 |
| Red Hat OpenStack 1.5 1777436150 | earliest → < 1777436150 | 1777436150 |
| Red Hat Quay 3.10 1775169155 | earliest → < 1775169155 | 1775169155 |
| Red Hat Quay 3.12 1775253092 | earliest → < 1775253092 | 1775253092 |
| Red Hat Quay 3.15 1775169219 | earliest → < 1775169219 | 1775169219 |
| Red Hat Quay 3.16 1779204086 | earliest → < 1779204086 | 1779204086 |
| Red Hat Quay 3.9 1775169218 | earliest → < 1775169218 | 1775169218 |
| Red Hat Trusted Artifact Signer 1.4 1775815407 | earliest → < 1775815407 | 1775815407 |
| Migration Toolkit for Containers | Versions not published | |
| Migration Toolkit for Virtualization | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat AI Inference Server | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenStack Platform 18.0 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| Red Hat Quay 3.1 1775169155 | earliest → < 1775169155 | 1775169155 |
| Service Telemetry Framework 1.5 1777436150 | earliest → < 1777436150 | 1777436150 |
| Red Hat Migration Toolkit 1.8 1783931722 | earliest → < 1783931722 | 1783931722 |
| Red Hat Migration Toolkit for Containers 1.8 1783931722 | earliest → < 1783931722 | 1783931722 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of pyasn1
The 9 CVEs of pyasn1 →
CVE-2026-119197
pyasn1 is a generic ASN.1 library for Python
7.5
High
CVE-2026-119196
pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding
7.5
High
CVE-2026-119195
pyasn1 is a generic ASN.1 library for Python
7.5
High
CVE-2026-119194
pyasn1 is a generic ASN.1 library for Python
7.5
High