pyasn1 <=0.6.2 DoS via uncontrolled ASN.1 recursion
CVE-2026-30922 Published on March 18, 2026

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-30922 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

NONE

Availability Impact:

HIGH

Weakness Types

What is a Stack Exhaustion Vulnerability?

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

CVE-2026-30922 has been classified to as a Stack Exhaustion vulnerability or weakness.

What is an Infinite Loop Vulnerability?

The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.

CVE-2026-30922 has been classified to as an Infinite Loop vulnerability or weakness.

Products Associated with CVE-2026-30922

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-30922 are published in these products:

Canonical Ubuntu Linux

Red Hat Ansible Automation Platform

Red Hat Enterprise Linux (RHEL)

Red Hat Enterprise Linux Eus

Red Hat Rhel Aus

Red Hat Rhel Eus Long Life

Red Hat Rhel Tus

Red Hat Rhel E4s

Red Hat Rhel Eus

Red Hat Ai Inference Server

Red Hat Enterprise Linux Ai

Red Hat Openshift Ai

Red Hat Stf

Red Hat Quay

Red Hat Trusted Artifact Signer

Red Hat Rhmt

Red Hat Migration Toolkit Virtualization

Red Hat Openshift Lightspeed

Red Hat Service Mesh

Red Hat Openshift

Red Hat Openstack

Red Hat Satellite

Oracle

Affected Versions

pyasn1:

Version < 0.6.3 is affected.

Red Hat Ansible Automation Platform 2.5 for RHEL 8:

Version 0:0.6.3-1.el8ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.5 for RHEL 8:

Version 0:4.6.29-2.el8ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.5 for RHEL 9:

Version 0:0.6.3-1.el9ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.5 for RHEL 9:

Version 0:4.6.29-2.el9ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.6 for RHEL 9:

Version 0:0.6.3-1.el9ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.6 for RHEL 9:

Version 0:4.7.12-1.el9ap and below * is unaffected.

Red Hat Enterprise Linux 10:

Version 0:4.16.0-13.el10_1.4 and below * is unaffected.
Version 0:4.16.0-21.el10_2.1 and below * is unaffected.

Red Hat Enterprise Linux 10.0 Extended Update Support:

Version 0:4.16.0-5.el10_0.9 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:4.2.1-129.el8_10.25 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:4.9.0-54.el8_10.33 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support:

Version 0:4.2.1-65.el8_4.28 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support:

Version 0:4.1.1-90.el8_4.25 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On:

Version 0:4.2.1-65.el8_4.28 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On:

Version 0:4.1.1-90.el8_4.25 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support:

Version 0:4.2.1-89.el8_6.22 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Telecommunications Update Service:

Version 0:4.2.1-89.el8_6.22 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Telecommunications Update Service:

Version 0:4.9.0-16.el8_6.22 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions:

Version 0:4.2.1-89.el8_6.22 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions:

Version 0:4.9.0-16.el8_6.22 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 0:4.2.1-112.el8_8.17 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 0:4.9.0-40.el8_8.19 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 0:4.2.1-112.el8_8.17 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 0:4.9.0-40.el8_8.19 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 0:4.10.0-110.el9_8.2 and below * is unaffected.
Version 0:4.10.0-98.el9_7.13 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions:

Version 0:4.10.0-43.el9_2.22 and below * is unaffected.

Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions:

Version 0:4.10.0-62.el9_4.25 and below * is unaffected.

Red Hat Enterprise Linux 9.6 Extended Update Support:

Version 0:4.10.0-86.el9_6.17 and below * is unaffected.

Red Hat AI Inference Server 3.3:

Version 1778244531 and below * is unaffected.

Red Hat Ansible Automation Platform 2.5:

Version 1777398315 and below * is unaffected.

Red Hat Ansible Automation Platform 2.5:

Version 1777403872 and below * is unaffected.

Red Hat Ansible Automation Platform 2.5:

Version 1777402264 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1777296732 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1777311120 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1777387242 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1774417022 and below * is unaffected.

Red Hat Enterprise Linux AI 3.3:

Version 1778677745 and below * is unaffected.

Red Hat Enterprise Linux AI 3.3:

Version 1778666124 and below * is unaffected.

Red Hat Migration Toolkit 1.8:

Version 1783931722 and below * is unaffected.

Red Hat OpenShift AI 2.25:

Version 1776343111 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1778263407 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471672 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471731 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471849 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471734 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471879 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782472374 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471606 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471796 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471661 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471753 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471740 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471834 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471730 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471835 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471697 and below * is unaffected.

Red Hat Quay 3.1:

Version 1775169155 and below * is unaffected.

Red Hat Quay 3.12:

Version 1775253092 and below * is unaffected.

Red Hat Quay 3.15:

Version 1775169219 and below * is unaffected.

Red Hat Quay 3.16:

Version 1779204086 and below * is unaffected.

Red Hat Quay 3.9:

Version 1775169218 and below * is unaffected.

Red Hat Trusted Artifact Signer 1.4:

Version 1775815407 and below * is unaffected.

Red Hat Service Telemetry Framework 1.5:

Version 1777452540 and below * is unaffected.

Red Hat Service Telemetry Framework 1.5:

Version 1777407251 and below * is unaffected.

Red Hat Service Telemetry Framework 1.5:

Version 1777436150 and below * is unaffected.

Red Hat Migration Toolkit for Containers: Red Hat Migration Toolkit for Virtualization: Red Hat Migration Toolkit for Virtualization: Red Hat OpenShift Lightspeed: Red Hat OpenShift Lightspeed: Red Hat OpenShift Service Mesh 3: Red Hat AI Inference Server: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenStack Platform 18.0: Red Hat Satellite 6: Red Hat Satellite 6: Red Hat Trusted Artifact Signer:

Exploit Probability

EPSS

0.80%

Percentile

52.93%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.

pyasn1 <=0.6.2 DoS via uncontrolled ASN.1 recursionCVE-2026-30922 Published on March 18, 2026

Vulnerability Analysis

Weakness Types

What is a Stack Exhaustion Vulnerability?

What is an Infinite Loop Vulnerability?

Products Associated with CVE-2026-30922

Affected Versions

Exploit Probability

pyasn1 <=0.6.2 DoS via uncontrolled ASN.1 recursion
CVE-2026-30922 Published on March 18, 2026