pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| pyasn1 | pyasn1 | affected |
|
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Pyasn1 | Pyasn1 |
|
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4557-1 | pyasn1 security update |
Debian DSA |
DSA-6194-1 | pyasn1 security update |
Github GHSA |
GHSA-jr27-m4p2-rc6r | Denial of Service in pyasn1 via Unbounded Recursion |
Ubuntu USN |
USN-8129-1 | pyasn1 vulnerability |
Ubuntu USN |
USN-8134-1 | pyasn1 vulnerabilities |
No CVSS v4.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.893% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:* |
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-835 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_0
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Pyasn1
Pyasn1 pyasn1 |
|
| Vendors & Products |
Pyasn1
Pyasn1 pyasn1 |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue. | |
| Title | pyasn1 Vulnerable to Denial of Service via Unbounded Recursion | |
| Weaknesses | CWE-674 | |
| References |
| |
| Metrics |
cvssV3_1
|