CVE-2026-30922

What it actually does

CVE-2026-30922 is an unauthenticated denial-of-service vulnerability in pyasn1 before version 0.6.3. The ASN.1 decoder can recurse without sufficient depth control when parsing attacker-supplied BER/DER-like data containing deeply nested SEQUENCE or SET elements, especially tags 0x30 or 0x31 using indefinite-length marker 0x80. A crafted input can drive recursive decoder calls until Python raises RecursionError, exhausts memory, or terminates the host process, causing loss of availability for any application path that decodes untrusted ASN.1 data. This issue is distinct from pyasn1 OID integer-overflow fixes and is not mitigated by MAX_OID_ARC_CONTINUATION_OCTETS.

Why it matters to the business

Applications that accept ASN.1-encoded data from untrusted sources can be crashed remotely, potentially interrupting authentication, certificate processing, telecom, identity, directory, cryptographic, or protocol-handling services that depend on pyasn1. Although there is no known KEV listing, ransomware association, or mature public exploitation indicated, the vulnerability has a network-reachable, low-complexity, no-authentication CVSS profile, so internet-facing or high-throughput services using pyasn1 should be prioritized for upgrade to avoid service outages and operational disruption.

How an attack unfolds

An attacker identifies an application endpoint, protocol listener, API, message consumer, or file-processing workflow that passes ASN.1 data to pyasn1 for decoding. The attacker sends a malicious ASN.1 payload composed of many nested constructed elements, commonly repeated SEQUENCE or SET tags with indefinite-length encodings. When the vulnerable decoder processes the payload, it repeatedly descends into nested structures without enforcing a safe recursion limit. The Python runtime eventually raises a recursion-depth exception, consumes excessive memory, or is killed by the operating system. If the vulnerable application does not isolate parsing failures or restart cleanly, the service becomes unavailable. Repeated submissions can sustain an outage.

How to fix it

Upgrade pyasn1 to version 0.6.3 or later everywhere it is used, including direct dependencies and transitive dependencies bundled into applications, containers, serverless packages, virtual environments, and vendor distributions. If an immediate upgrade is not possible, reduce exposure by rejecting untrusted ASN.1 inputs where feasible, enforcing strict request and file-size limits, applying parser timeouts, isolating ASN.1 decoding in a worker process with memory and CPU limits, and implementing graceful exception handling for RecursionError and MemoryError so a malformed input cannot crash the primary service. Do not assume fixes for pyasn1 OID decoding or CVE-2026-23490 mitigate this issue; this recursion flaw requires the 0.6.3 fix or an equivalent downstream backport.

How to confirm the fix worked

Confirm that all runtime environments resolve pyasn1 to version 0.6.3 or later using package inventory, lockfiles, container image scans, and runtime checks such as `python -m pip show pyasn1` or equivalent dependency tooling. Inspect dependency trees for transitive inclusion through packages that parse ASN.1, certificates, LDAP, Kerberos, SNMP, PKI, or identity protocols. Validate that rebuilt artifacts, deployed containers, and virtual environments no longer contain older pyasn1 versions. For exposure testing, use a controlled non-production environment to send deeply nested ASN.1 inputs to relevant parsing paths and verify the application rejects the input safely without process termination, OOM events, or repeated RecursionError crashes.

Typical attack path

1. Find a service, API, agent, message queue consumer, authentication component, certificate parser, or file import feature that accepts ASN.1-encoded input.
2. Confirm or infer that the application uses pyasn1 before version 0.6.3 to decode the supplied data.
3. Craft ASN.1 input containing thousands of nested SEQUENCE (0x30) or SET (0x31) elements with indefinite-length (0x80) markers.
4. Submit the payload to the reachable parsing path without needing credentials or user interaction.
5. Trigger uncontrolled recursive decoding until the Python process raises RecursionError, exhausts memory, or is terminated.
6. Repeat requests or submissions to keep the affected service degraded or unavailable.

How to detect it

To determine whether this was already exploited, review application logs, Python exception logs, service manager logs, container orchestration events, reverse proxy logs, and operating system memory/OOM logs for crashes or restarts correlated with requests, messages, uploads, or protocol inputs carrying ASN.1-like data. Look for repeated RecursionError exceptions, maximum recursion depth messages, MemoryError events, worker process exits, OOM killer messages, container restarts, and spikes in 5xx responses against endpoints or consumers that parse certificates, ASN.1 blobs, PKI data, LDAP/Kerberos/SNMP-related inputs, or uploaded binary payloads. Investigate clusters of failures from the same source IP, user agent, message producer, queue topic, or file ingestion source. In Python stack traces, look for pyasn1 decoder frames around ber/der/cer decoding immediately before RecursionError or process termination. Network payloads may contain long runs of nested ASN.1 constructed tags, especially repeated 0x30 0x80 or 0x31 0x80 byte sequences, although encrypted transport may require endpoint or application-layer logging to observe them.

• RecursionError: maximum recursion depth exceeded
• RecursionError: maximum recursion depth exceeded while calling a Python object
• MemoryError
• pyasn1.codec.ber.decoder
• pyasn1.codec.der.decoder
• pyasn1.codec.cer.decoder
• 0x30 0x80 0x30 0x80
• 0x31 0x80 0x31 0x80
• Killed process
• Out of memory: Killed process
• oom-kill
• OOMKilled
• CrashLoopBackOff
• maximum recursion depth exceeded

What your security team should do

• Inventory all applications, containers, virtual environments, and third-party components that include pyasn1, prioritizing internet-facing and unauthenticated parsing paths.
• Upgrade or backport pyasn1 version 0.6.3 or later and rebuild/redeploy affected artifacts rather than only updating source manifests.
• Review applications that process certificates, ASN.1 blobs, LDAP/Kerberos/SNMP/PKI data, signed messages, or uploaded binary files for reachable pyasn1 decoding paths.
• Add defensive limits around untrusted ASN.1 processing, including input-size limits, worker isolation, memory limits, timeouts, and safe handling of RecursionError and MemoryError.
• Search recent logs for Python recursion failures, memory exhaustion, OOM kills, and repeated malformed ASN.1 parsing errors from the same source addresses or workflows.
• Add monitoring and alerting for crash loops, sudden worker restarts, elevated 5xx responses, and memory spikes in services that depend on pyasn1.
• Because EPSS is currently low and there is no KEV listing, treat this as a priority availability fix for exposed services rather than evidence of confirmed exploitation, while still patching broadly during the next maintenance cycle.