Bug 2448553 (CVE-2026-30922)

Summary:	CVE-2026-30922 pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	adudiak, alinfoot, anpicker, anthomas, aprice, bbrownin, bdettelb, bparees, caswilli, cmyers, dfreiber, dnakabaa, doconnor, drow, dschmidt, dtrifiro, dymurray, ebourniv, eglynn, ehelms, erezende, ggainey, hasun, ibolton, jburrell, jdobes, jfula, jjoyce, jkoehler, jlanda, jmatthew, jmitchel, jmontleo, jowilson, jsamir, jschluet, juwatts, jwong, kaycoth, kgaikwad, kshier, lball, lcouzens, lgallett, lhh, lphiri, mburns, mgarciac, mhayden, mhulan, mrunge, ngough, nmoumoul, nyancey, oezr, omaciel, ometelka, orabin, osousa, pakotvan, pbohmill, pcreech, pgaikwad, ptisnovs, rbryant, rchan, rjohnson, sbunciak, sdoran, simaishi, slucidi, smallamp, smcdonal, sseago, stcannon, sthirugn, syedriko, teagle, tmalecek, ttakamiy, veshanka, vimartin, vkumar, weaton, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-03-18 04:04:41 UTC

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.