7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30922

CVE-2026-30922: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the pyasn1 library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested SEQUENCE (0x30) or SET (0x31) tags with "Indefinite Length" (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (MAX_OID_ARC_CONTINUATION_OCTETS) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30922

CVE-2026-30922:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pyasn1	pip	<= 0.6.2	0.6.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an uncontrolled recursion (CWE-674) in the pyasn1 library's BER decoder, leading to a denial of service. The root cause is the lack of a depth check during the recursive decoding of nested ASN.1 structures. The fixing commit, 5a49bd1fe93b5b866a1210f6bf0a3924f21572c8, addresses this by modifying the Decoder.__call__ method in pyasn1/codec/ber/decoder.py. This function is the core of the recursive decoding process (referenced as decodeFun in the codebase). The patch adds logic to track the recursion depth (_nestingLevel) and raises a PyAsn1Error if it exceeds a newly defined MAX_NESTING_DEPTH limit. This prevents the process from crashing due to a stack overflow. While the vulnerability description correctly identifies several functions (indefLenValueDecoder, valueDecoder, _decodeComponentsSchemaless) as locations where the recursive calls are made, the fundamental vulnerability lies in the Decoder.__call__ method itself, which lacked the necessary safeguards. During an exploit, this function would be the one appearing repeatedly in the stack trace.

Vulnerable functions

Decoder.__call__

pyasn1/codec/ber/decoder.py

This function is the main entry point for the BER decoder and is called recursively to process nested ASN.1 structures. Prior to the patch, it lacked any check on the recursion depth. An attacker could provide a deeply nested ASN.1 payload, causing this function to call itself until the Python recursion limit was exceeded, resulting in a `RecursionError` and a denial of service. The patch introduces a depth check using `_nestingLevel` and `MAX_NESTING_DEPTH` to prevent this unbounded recursion.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.