CVE-2026-30922

Aliases:GHSA-jr27-m4p2-rc6rECHO-b1bf-5a18-ca74PYSEC-2026-2263RHSA-2026:13902RHSA-2026:13917RHSA-2026:20588RHSA-2026:22131RHSA-2026:22132RHSA-2026:22133RHSA-2026:22134RHSA-2026:22135RHSA-2026:22969RHSA-2026:22970RHSA-2026:22987DEBIAN-CVE-2026-30922CGA-2469-3jv7-6fj5CGA-3cpv-fcjw-9h87CGA-4wq2-pfh6-mfh5CGA-4xjm-q9g3-rm6gCGA-64cr-c5hh-44mjCGA-66p3-v5r5-8743CGA-6v3w-f89q-h2c6CGA-83h6-mv5c-5723CGA-8m2g-mccx-pp67CGA-8qwh-2848-r9jcCGA-94w7-7v88-3639CGA-98hf-mgvx-4jfpCGA-cq68-q6j3-vff3CGA-f29f-mhj6-fp7rCGA-f399-9q52-ff3rCGA-fw5f-fj8v-wfmhCGA-gfj6-872c-pfc7CGA-h97f-9v4p-m62fCGA-m6pc-x8fw-5vv3CGA-p6cj-wrg5-73mqCGA-2794-3hfg-gg3wCGA-28w4-8j5x-hj9gCGA-2wj6-p7gq-272wCGA-325x-h866-73vvCGA-37r8-m53g-v433CGA-4mvm-pfjr-43fgCGA-4wgq-qvv4-4f5xCGA-52v9-7q95-8382CGA-56q5-46x4-g5j5CGA-583r-v8fc-mr69CGA-59xq-hrg5-hm35CGA-5hh7-hpr2-c58pCGA-5wxf-q5gp-qv8pCGA-63mh-7r96-4p2fCGA-6ffc-h2h7-c373CGA-6pp9-pw3h-wx95CGA-6r2g-7g7m-p944CGA-6r4p-pcj4-9rqgCGA-6v2v-v7fv-g6qvCGA-74m5-xvj9-6pxhCGA-776v-x5rm-65jhCGA-7cmp-8gg2-cx7hCGA-7h55-xvqx-f9f9CGA-7j9j-hh95-57jwCGA-7jv7-m5jh-7xgcCGA-7v2w-m7jc-xf3jCGA-8639-c9pg-5qqgCGA-86wj-j7jh-r2jfCGA-877m-jrpg-2w8mCGA-8p5r-phfj-8hq9CGA-99gj-fxgm-2fghCGA-9pfw-rg8c-fv2jCGA-9q95-qw8f-537pCGA-9wvq-c36j-24mrCGA-9wwv-f774-g9hpCGA-cfm9-w5xw-p7jpCGA-cgpx-prqc-532xCGA-cm36-x6mw-m96hCGA-cwh7-4vrr-7gxgCGA-f46h-h4q5-rrhvCGA-fc93-4g4f-qmq7CGA-fh6c-4x4q-vgpcCGA-fhjm-927r-wj5hCGA-fmgf-23jg-ffg4CGA-fwrv-gmh9-w575CGA-g3cf-mhwx-rx6jCGA-g5hr-jmr3-2cp5CGA-gc8q-wrgp-2fmhCGA-grm4-qwpx-jh7fCGA-h2wx-wj23-6w5gCGA-hprv-48c4-c4x4CGA-jppc-3fxg-xv4fCGA-jqj8-ch3f-2hchCGA-jqp3-6w2h-g3c6CGA-jw93-j4g4-4cx2CGA-jxc6-7738-rvhrCGA-m42q-3wwv-5g5mCGA-m7g6-vf5j-h38fCGA-mcm7-pf2q-75jpCGA-mmh2-8v84-7hwcCGA-q555-8x7p-5f23CGA-q8vf-f5jh-76c4CGA-q8wg-f6pg-92mpCGA-qm98-xq8q-rcjgCGA-qpvh-gcv4-949cCGA-qvm4-x26x-jqfwCGA-qwh9-pv8h-6vc2CGA-qwvx-824m-g9q3CGA-qx86-48fg-gjmqCGA-r45h-5g8m-m3g3CGA-r8q2-w4h8-gwh8CGA-rff2-7x9v-cm88CGA-v258-p269-r657CGA-v58q-5wqv-7qwqCGA-vv9v-7vq4-98q5CGA-vw3f-fhjm-8xv9CGA-w6xx-8x8w-67vmCGA-w7qr-g6p2-46pgCGA-x44v-6wqv-c247CGA-x4j4-cr47-hxx9CGA-x59p-7px9-m42hCGA-xfwr-4g4x-jh7fCGA-xgfv-h99x-9rrgCGA-xh5r-wg4w-8cccCGA-xp39-5px7-mmgrCGA-xq85-75gg-25gxCGA-wjmr-4f8j-cm68
Advisory lineage Upstream: 0 Downstream: 34
Modified
Published: 18 Mar 2026, 02:29
Last modified:17 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.8% LOW
1% probability +0.78%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

18 Mar 2026, 02:29
Published
Vulnerability first disclosed
17 Sept 2026, 12:04
Last Modified
Vulnerability information updated

Description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.80%• Percentile: 55%

Techniques & Countermeasures

  • CWE-674•Uncontrolled Recursion

    The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

  • CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

    The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Systems

  • chainguard•airflow-2

    < 2.11.2-r3

  • chainguard•airflow-3

    < 3.1.8-r9

  • chainguard•ansible-operator

    < 1.42.2-r0

  • chainguard•ansible-operator-fips

    < 1.42.2-r0

  • chainguard•apache-beam-python-3.12-sdk

    < 2.71.0-r1

  • chainguard•apache-beam-python-3.13-sdk

    < 2.71.0-r1

  • chainguard•authentik

    < 2026.2.1-r4

  • chainguard•authentik-fips

    < 2026.2.1-r3

  • chainguard•awx

    < 24.6.1-r31

  • chainguard•barman-cloudnative-pg

    < 3.18.0-r1

  • chainguard•datadog-agent-7.71-core-integrations

    all

  • chainguard•datadog-agent-7.72-core-integrations

    all

  • chainguard•datadog-agent-7.73-core-integrations

    < 7.73.3-r23

  • chainguard•datadog-agent-7.74-core-integrations

    < 7.74.1-r24

  • chainguard•datadog-agent-7.75-core-integrations

    all

  • chainguard•datadog-agent-7.76

    all

  • chainguard•datadog-agent-7.76-core-integrations

    < 7.76.3-r32

  • chainguard•datadog-agent-7.77-core-integrations

    < 7.77.3-r5

  • chainguard•datadog-agent-fips-7.71-core-integrations

    all

  • chainguard•datadog-agent-fips-7.72-core-integrations

    all

  • chainguard•datadog-agent-fips-7.73-core-integrations

    < 7.73.3-r26

  • chainguard•datadog-agent-fips-7.74-core-integrations

    < 7.74.1-r26

  • chainguard•datadog-agent-fips-7.75-core-integrations

    < 7.75.4-r10

  • chainguard•datadog-agent-fips-7.76-core-integrations

    < 7.76.3-r4

  • chainguard•dbt-bigquery

    < 1.10.3-r1

  • chainguard•gitlab-toolbox-ce-18.7

    < 18.7.5-r1

  • chainguard•gitlab-toolbox-ce-18.8

    < 18.8.5-r1

  • chainguard•gitlab-toolbox-ce-18.9

    < 18.9.2-r1

  • chainguard•gitlab-toolbox-ce-fips-18.7

    < 18.7.5-r1

  • chainguard•gitlab-toolbox-ce-fips-18.8

    < 18.8.5-r1

  • chainguard•gitlab-toolbox-ce-fips-18.9

    < 18.9.2-r1

  • chainguard•k8s-sidecar

    < 2.5.1-r2

  • chainguard•keep-api

    < 0.51.0-r0

  • chainguard•keep-api-fips

    < 0.51.0-r0

  • chainguard•kubeflow-jupyter-web-app

    < 1.10.0-r13

  • chainguard•kubeflow-pipelines-apiserver

    < 2.16.0-r9

  • chainguard•kubeflow-pipelines-visualization-server

    < 2.16.0-r2

  • chainguard•kubeflow-volumes-web-app

    < 1.10.0-r12

  • chainguard•label-studio

    < 1.23.0-r1

  • chainguard•litellm

    < 1.82.3.0-r0

  • chainguard•localstack

    < 4.14.0-r4

  • chainguard•metaflow-service

    < 2.5.0-r7

  • chainguard•metaflow-service-fips

    < 2.5.0-r1

  • chainguard•mlflow

    < 3.10.1-r1

  • chainguard•mlflow-iamguarded-compat

    < 3.10.1-r1

  • chainguard•pgadmin4

    < 9.13-r2

  • chainguard•pgadmin4-fips

    < 9.13-r1

  • chainguard•py3-cassandra-medusa

    < 0.27.0-r5

  • chainguard•py3.13-duplicity

    all

  • chainguard•request-1276

    < 0.27.0-r6

Showing first 50 affected entries in server-rendered view.

References (64)