Към съдържанието
Търсене

CVE-2026-30922: pyasn1, отказ на услуга

7.5

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: има публичен пример за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.

Засегнати продукти

  • pyasn1 pyasn1: < 0.6.3
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8: 0:0.6.3-1.el8ap преди *
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9: 0:0.6.3-1.el9ap преди *
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9: 0:0.6.3-1.el9ap преди *
  • Red Hat Red Hat Enterprise Linux 10: 0:4.16.0-13.el10_1.4 преди *; 0:4.16.0-21.el10_2.1 преди *
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: 0:4.16.0-5.el10_0.9 преди *
  • Red Hat Red Hat Enterprise Linux 8: 0:4.2.1-129.el8_10.25 преди *
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: 0:4.2.1-65.el8_4.28 преди *
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: 0:4.2.1-65.el8_4.28 преди *
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: 0:4.2.1-89.el8_6.22 преди *
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service: 0:4.2.1-89.el8_6.22 преди *
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions: 0:4.2.1-89.el8_6.22 преди *
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service: 0:4.2.1-112.el8_8.17 преди *
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: 0:4.2.1-112.el8_8.17 преди *
  • Red Hat Red Hat Enterprise Linux 9: 0:4.10.0-110.el9_8.2 преди *; 0:4.10.0-98.el9_7.13 преди *
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: 0:4.10.0-43.el9_2.22 преди *
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: 0:4.10.0-62.el9_4.25 преди *
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support: 0:4.10.0-86.el9_6.17 преди *
  • Red Hat Red Hat AI Inference Server 3.3: 1778244531 преди *
  • Red Hat Red Hat Ansible Automation Platform 2.5: 1777398315 преди *
  • Red Hat Red Hat Ansible Automation Platform 2.6: 1777296732 преди *
  • Red Hat Red Hat Enterprise Linux AI 3.3: 1778677745 преди *
  • Red Hat Red Hat Migration Toolkit 1.8: 1783931722 преди *
  • Red Hat Red Hat OpenShift AI 2.25: 1776343111 преди *
  • Red Hat Red Hat OpenShift AI 3.3: 1778263407 преди *
  • Red Hat Red Hat OpenStack 1.5: 1777452540 преди *
  • Red Hat Red Hat Quay 3.10: 1775169155 преди *
  • Red Hat Red Hat Quay 3.12: 1775253092 преди *
  • Red Hat Red Hat Quay 3.15: 1775169219 преди *
  • Red Hat Red Hat Quay 3.16: 1779204086 преди *
  • Red Hat Red Hat Quay 3.9: 1775169218 преди *
  • Red Hat Red Hat Trusted Artifact Signer 1.4: 1775815407 преди *
  • Red Hat Migration Toolkit for Containers
  • Red Hat Migration Toolkit for Virtualization
  • Red Hat OpenShift Lightspeed
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat AI Inference Server
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenStack Platform 18.0
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Trusted Artifact Signer

Вид слабост

История

  • 18 март 2026 Публикувано

Други уязвимости в pyasn1 pyasn1

Първоизточници

CVE-2026-30922: pyasn1, отказ на услуга | freedomonline.bg