Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-30922 is a high-severity Uncontrolled Recursion (CWE-674) vulnerability in Pyasn1 Pyasn1. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-30922 is a denial-of-service vulnerability in the pyasn1 library, a generic ASN.1 library for Python. Versions prior to 0.6.3 are affected by uncontrolled recursion during the decoding of ASN.1 data containing deeply nested structures. An attacker can craft a payload with thousands of nested SEQUENCE (0x30) or SET (0x31) tags using indefinite length (0x80) markers, triggering excessive recursive calls in the decoder. This leads to a Python RecursionError or out-of-memory condition, crashing the host application. The issue is distinct from CVE-2026-23490, which addressed integer overflows in OID decoding, and the prior fix does not mitigate this recursion problem. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-674 (Uncontrolled Recursion).
Any unauthenticated remote attacker can exploit this vulnerability by supplying malicious ASN.1-encoded input to an application using an affected version of pyasn1 for parsing. Exploitation requires no privileges or user interaction, making it highly accessible over network connections where ASN.1 data is processed, such as in protocols involving certificates, cryptographic exchanges, or network management. Successful exploitation crashes the Python interpreter or consuming application through recursion exhaustion or memory depletion, resulting in high-impact availability disruption without affecting confidentiality or integrity.
The pyasn1 project released version 0.6.3 to fix this issue, as detailed in the GitHub commit 25ad481c19fdb006e20485ef3fc2e5b3eff30ef0 and security advisory GHSA-jr27-m4p2-rc6r. Security announcements on oss-security (March 20, 2026) and Debian LTS (May 2026) recommend upgrading to 0.6.3 or later. Practitioners should audit dependencies for vulnerable pyasn1 versions and apply updates promptly, especially in ASN.1-processing components.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12747
Vulnerability Data
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a…
more
crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover unreachable loop exit conditions through static analysis, fuzzing, or execution tracing.
Input validation can reject or constrain data that would otherwise drive unbounded recursive calls.
Flaw remediation processes identify and correct infinite-loop defects reported from testing or operations.
Requiring documented development processes and secure coding standards reduces introduction of loops whose termination conditions are unreachable.
DoS protection mechanisms limit the resource-exhaustion impact of uncontrolled recursion without eliminating the flaw.
System monitoring can observe anomalous resource consumption that signals runaway recursion after it begins.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding errors such as missing recursion limits or termination conditions.
Runtime monitoring of compute resources can detect excessive consumption caused by uncontrolled recursion.
Vulnerability identification processes can discover and record uncontrolled recursion flaws before deployment.
Capacity monitoring and resource provisioning can absorb or limit the impact of runaway recursion.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect excessive recursion via static analysis or fuzzing.
Secure development life cycle requires controls that prevent uncontrolled recursion through design and code review.
Application security requirements can mandate recursion limits or stack-depth checks.
Secure system architecture principles include resource-management and input-validation rules that limit recursion.
Secure coding standards directly prohibit or constrain recursive constructs that could exhaust stack or memory.
Capacity management includes monitoring and limits that mitigate resource exhaustion from runaway recursion.