CVE-2026-30922

HighPublic PoC

Published: 18 March 2026

Published

18 March 2026

Modified

01 May 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0003 7.4th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-30922 is a high-severity Uncontrolled Recursion (CWE-674) vulnerability in Pyasn1 Pyasn1. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 7.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Flaw remediation requires timely patching of the pyasn1 library to version 0.6.3 or later, directly eliminating the uncontrolled recursion vulnerability in ASN.1 decoding.

SC-5 Denial-of-service Protection good match

prevent

Denial-of-service protection implements resource limits and monitoring to block crafted ASN.1 payloads causing recursion exhaustion or memory depletion.

SI-10 Information Input Validation partial match

prevent

Information input validation detects and rejects malformed deeply nested ASN.1 structures with indefinite length markers before they reach the vulnerable pyasn1 decoder.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

CVE enables remote unauthenticated DoS by supplying crafted deeply-nested ASN.1 input that triggers uncontrolled recursion in pyasn1 decoder, directly matching Application or System Exploitation sub-technique under Endpoint Denial of Service.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a…

crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.

Deeper analysisAI

CVE-2026-30922 is a denial-of-service vulnerability in the pyasn1 library, a generic ASN.1 library for Python. Versions prior to 0.6.3 are affected by uncontrolled recursion during the decoding of ASN.1 data containing deeply nested structures. An attacker can craft a payload with thousands of nested SEQUENCE (0x30) or SET (0x31) tags using indefinite length (0x80) markers, triggering excessive recursive calls in the decoder. This leads to a Python RecursionError or out-of-memory condition, crashing the host application. The issue is distinct from CVE-2026-23490, which addressed integer overflows in OID decoding, and the prior fix does not mitigate this recursion problem. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-674 (Uncontrolled Recursion).

Any unauthenticated remote attacker can exploit this vulnerability by supplying malicious ASN.1-encoded input to an application using an affected version of pyasn1 for parsing. Exploitation requires no privileges or user interaction, making it highly accessible over network connections where ASN.1 data is processed, such as in protocols involving certificates, cryptographic exchanges, or network management. Successful exploitation crashes the Python interpreter or consuming application through recursion exhaustion or memory depletion, resulting in high-impact availability disruption without affecting confidentiality or integrity.

The pyasn1 project released version 0.6.3 to fix this issue, as detailed in the GitHub commit 25ad481c19fdb006e20485ef3fc2e5b3eff30ef0 and security advisory GHSA-jr27-m4p2-rc6r. Security announcements on oss-security (March 20, 2026) and Debian LTS (May 2026) recommend upgrading to 0.6.3 or later. Practitioners should audit dependencies for vulnerable pyasn1 versions and apply updates promptly, especially in ASN.1-processing components.