Source: pyasn1 Version: 0.6.2-1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for pyasn1. CVE-2026-30922[0]: | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the | `pyasn1` library is vulnerable to a Denial of Service (DoS) attack | caused by uncontrolled recursion when decoding ASN.1 data with | deeply nested structures. An attacker can supply a crafted payload | containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) | tags with "Indefinite Length" (`0x80`) markers. This forces the | decoder to recursively call itself until the Python interpreter | crashes with a `RecursionError` or consumes all available memory | (OOM), crashing the host application. This is a distinct | vulnerability from CVE-2026-23490 (which addressed integer overflows | in OID decoding). The fix for CVE-2026-23490 | (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion | issue. Version 0.6.3 fixes this specific issue. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-30922 https://www.cve.org/CVERecord?id=CVE-2026-30922 [1] https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r [2] https://github.com/pyasn1/pyasn1/commit/5a49bd1fe93b5b866a1210f6bf0a3924f21572c8 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
