Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-30922

CVE-2026-30922HIGH

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0093   59.3     —

AFFECTED
  Product  Versions   Fixed
  pyasn1   < 0.6.3 –  —

TIMELINE
  Mar 7   Reserved by GitHub_M
  Mar 18  Published (CNA: GitHub_M)
  Aug 24  EXPLOIT PUBLISHED — CVE-2026-30922 (pyasn1). Public exploit reference added.
  Sep 2   EXPLOIT PUBLISHED — CVE-2026-30922 (pyasn1). Public exploit reference added.
  Sep 7   EXPLOIT PUBLISHED — CVE-2026-30922 (pyasn1). Public exploit reference added.
  Sep 9   EXPLOIT PUBLISHED — CVE-2026-30922 (pyasn1). Public exploit reference added.
  Sep 10  EXPLOIT PUBLISHED — CVE-2026-30922 (pyasn1). Public exploit reference added.

CWE-674 · CNA: GitHub_M · CVSS v3.1 · 44 references · NVD status: Modified

Description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.

Lifecycle

Complete event history — 7 events, chronological
Date	Event	Detail
March 7, 2026	Reserved	Reserved by GitHub_M
March 18, 2026	Published	Published (CNA: GitHub_M)
August 24, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-30922 (pyasn1). Public exploit reference added.
September 2, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-30922 (pyasn1). Public exploit reference added.
September 7, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-30922 (pyasn1). Public exploit reference added.
September 9, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-30922 (pyasn1). Public exploit reference added.
September 10, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-30922 (pyasn1). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
pyasn1	pyasn1	—	< 0.6.3	—

Weaknesses

CWE-674

References (44)

http://www.openwall.com/lists/oss-security/2026/03/20/4
https://access.redhat.com/errata/RHSA-2026:10184 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:12176 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:13508 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:13512 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:13545 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:13553 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:13902 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:13916 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:13917 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:14020 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:16009 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:17083 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:17611 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:19138 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:19355 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:19375 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:19712 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:20588 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:22131 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:22132 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:22133 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:22134 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:22135 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:22969 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:22970 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:22987 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:24761 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:24762 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:37275 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:41928 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:6309 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:65126 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:6568 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:6720 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:6912 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:6926 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/errata/RHSA-2026:8437 [vendor-advisory, x_refsource_REDHAT]
https://access.redhat.com/security/cve/CVE-2026-30922 [vdb-entry, x_refsource_REDHAT]
https://bugzilla.redhat.com/show_bug.cgi?id=2448553 [issue-tracking, x_refsource_REDHAT]
https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0 [x_refsource_MISC]
https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r [x_refsource_CONFIRM]
https://lists.debian.org/debian-lts-announce/2026/05/msg00001.html
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-30922.json [x_sadp-csaf-vex]

Authoritative record: CVE-2026-30922 at cve.org

Vendors: pyasn1

Weaknesses: CWE-674

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-30922 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.