CVE Tracker

CVE-2026-30922 @ Library

Status
not_applicable
Priority
2.25
Match score
4.0
Risk
DoS Remote
CVSS
7.5 HIGH
Reason
cpe: pyasn1; pkgs: pyasn1; version: in-range: pyasn1-0.1.9-2; risk:memory_corruption
Created
2026-08-03T20:10:50Z
Updated
2026-08-03T20:31:45Z
Closed
2026-08-03T20:31:45Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

PackageCommands
pyasn1-0.1.9-2

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: pyasn1

Same product CVEs in your queue

Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.

CVECVSSKEVSystemsStatus MatchedAlready related
CVE-2026-59885 7.5 Library not_applicable pyasn1 → CVE-2026-59884
CVE-2026-23490 7.5 Library not_applicable pyasn1 → CVE-2026-59884
CVE-2026-59886 7.5 Library not_applicable pyasn1 → CVE-2026-59884

Related CVE (same fix)

This CVE is subordinated to primary CVE-2026-59884 — same product as CVE-2026-59884

Host OS / kernel

OS
Debian GNU/Linux 9 (stretch) (9) · debian
Arch
x86_64
kernel_release
uname -r → 4.9.0-19-amd64
kernel_version
uname -v → #1 SMP Debian 4.9.320-2 (2022-06-30)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.

Determination

Related to primary CVE-2026-59884: same product as CVE-2026-59884

Update status

Add note only

Mitigation log

2026-08-03T20:31:45Z — not_applicable
Related to primary CVE-2026-59884: same product as CVE-2026-59884

References

NVD: CVE-2026-30922