CVE-2026-30922

An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.

This vulnerability is rated as having an Important impact by Red Hat because a remote, unauthenticated attacker can crash services or exhaust system resources by supplying malformed input, without needing elevated privileges. While pyasn1 is widely bundled across Red Hat container images and automation tools, the risk is concentrated in services that directly ingest untrusted network data. Applications and utilities operating strictly on authenticated or locally generated inputs face significantly reduced exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.