PyPI: pyasn1
CVE-2026-30922
Safety vulnerability ID: SFTY-20260317-69628
Safety legacy ID: pyup.io-89623
Affected versions of the pyasn1 package are vulnerable to Denial of Service (DoS) due to uncontrolled recursion when decoding deeply nested ASN.1 data. The vulnerability exists in the BER decoder’s indefLenValueDecoder, valueDecoder, and _decodeComponentsSchemaless code paths, where decodeFun is recursively invoked for nested SEQUENCE, SET, SEQUENCE OF, and SET OF elements without enforcing a recursion-depth limit.
Overview
Denial of Service in pyasn1 via Unbounded Recursion
Advisory
Affected versions of the pyasn1 package are vulnerable to Denial of Service (DoS) due to uncontrolled recursion when decoding deeply nested ASN.1 data. The vulnerability exists in the BER decoder’s indefLenValueDecoder, valueDecoder, and _decodeComponentsSchemaless code paths, where decodeFun is recursively invoked for nested SEQUENCE, SET, SEQUENCE OF, and SET OF elements without enforcing a recursion-depth limit.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260317-69628/CVE-2026-30922
- https://data.safetycli.com/changelogs/pyasn1/
- https://github.com/advisories/GHSA-jr27-m4p2-rc6r
- https://github.com/pyasn1/pyasn1/commit/5a49bd1fe93b5b866a1210f6bf0a3924f21572c8
- https://pypi.org/project/pyasn1
- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r
- https://github.com/pyasn1/pyasn1/commit/5a49bd1fe93b5b866a1210f6bf0a3924f21572c8
- https://github.com/pyasn1/pyasn1/releases/tag/v0.6.3
- https://nvd.nist.gov/vuln/detail/CVE-2026-30922
- https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0
- http://www.openwall.com/lists/oss-security/2026/03/20/4
- https://github.com/advisories/GHSA-jr27-m4p2-rc6r
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more