CVE-2026-30922High· 7.5▾ MidnightPoC availableAn unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x3…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.8%
Exploit / PoC code exists
Last analysed / modified upstream
0.8% → 1.0%
An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.
pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion — rated Important by Red Hat. Released 2026-03-18, updated 2026-10-15.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:24761 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:13512 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:24762
Workarounds / mitigations:
Affected packages:
pyasn1 < 0.6.3Patched in:
pyasn1 0.6.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-32282High· 7.8golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
CVE-2026-92822Medium· 6.2Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
CVE-2026-112895High· 7.5Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
CVE-2026-100354High· 7.5kin-openapi is a Go project for handling OpenAPI files
CVE-2026-69249High· 7.5python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers
CVE-2026-69248High· 7.4cryptography is a package designed to expose cryptographic primitives and recipes to Python developers