pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
Priority HIGH 72CWE-674Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 43 fixed, 9 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.
Summary
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00835 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial pyasn1 (pyasn1): 0.6.3pyasn1 (PyPI): 0.6.3Red Hat: 38 advisoriesRed Hat: 43 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pyasn1 | pyasn1 | before 0.6.3 | 0.6.3 | Patch available | CNA |
| — | pyasn1 (PyPI) | before 0.6.3 | 0.6.3 | Patch available | GHSA-jr27-m4p2-rc6r |
- pyasn1 Vendorpyasn1 Affected before 0.6.3 Fixed in 0.6.3 Patch available CNA
- pyasn1 (PyPI) Vendor— Affected before 0.6.3 Fixed in 0.6.3 Patch available GHSA-jr27-m4p2-rc6r
Remediation
- Fix · CNA pyasn1 (pyasn1) Fixed in 0.6.3
- Fix · GHSA-jr27-m4p2-rc6r pyasn1 (PyPI) Fixed in 0.6.3 Advisory →
Red Hat 38 advisories
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:41928 Released 2026-07-20 · Red Hat rating ImportantRed Hat Migration Toolkit for Containers
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
- RHSA-2026:37275 Released 2026-07-09 · Red Hat rating CriticalRHOAI 3.3.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9, registry.redhat.io/rhoai/odh-feast-operator-rhel9 +45
Show 35 more Red Hat advisories
- RHSA-2026:24761 Released 2026-06-09 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.29-2.el8ap, automation-gateway-proxy-server-2.5.10-6.el8ap, automation-gateway-server-2.5.20260422-3.el8ap +4
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.29-2.el9ap, automation-gateway-proxy-server-2.6.14-3.el9ap, automation-gateway-server-2.5.20260422-3.el9ap +4
- RHSA-2026:24762 Released 2026-06-09 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 python3-click-8.3.3-1.el10ap, receptor-1.6.5-1.el10ap, receptorctl-1.6.5-1.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.12-1.el9ap, automation-controller-cli-4.7.12-1.el9ap, automation-controller-server-4.7.12-1.el9ap +10
- RHSA-2026:22970 Released 2026-06-04 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-agents-4.10.0-86.el9_6.17, fence-agents-aliyun-4.10.0-86.el9_6.17, fence-agents-all-4.10.0-86.el9_6.17 +47
- RHSA-2026:22969 Released 2026-06-03 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) fence-agents-4.10.0-62.el9_4.25, fence-agents-common-4.10.0-62.el9_4.25, fence-agents-compute-4.10.0-62.el9_4.25 +11
- Red Hat Enterprise Linux High Availability E4S (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.25, fence-agents-all-4.10.0-62.el9_4.25, fence-agents-amt-ws-4.10.0-62.el9_4.25 +40
- Red Hat Enterprise Linux Resilient Storage E4S (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.25, fence-agents-all-4.10.0-62.el9_4.25, fence-agents-amt-ws-4.10.0-62.el9_4.25 +39
- RHSA-2026:22987 Released 2026-06-03 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-agents-4.10.0-43.el9_2.22, fence-agents-common-4.10.0-43.el9_2.22, fence-agents-compute-4.10.0-43.el9_2.22 +11
- Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.22, fence-agents-all-4.10.0-43.el9_2.22, fence-agents-amt-ws-4.10.0-43.el9_2.22 +40
- Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.22, fence-agents-all-4.10.0-43.el9_2.22, fence-agents-amt-ws-4.10.0-43.el9_2.22 +39
- RHSA-2026:22134 Released 2026-06-01 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) fence-agents-4.2.1-89.el8_6.22, fence-agents-all-4.2.1-89.el8_6.22, fence-agents-amt-ws-4.2.1-89.el8_6.22 +40
- Red Hat Enterprise Linux AppStream E4S (v.8.6) fence-agents-4.2.1-89.el8_6.22, fence-agents-all-4.2.1-89.el8_6.22, fence-agents-amt-ws-4.2.1-89.el8_6.22 +41
- Red Hat Enterprise Linux AppStream TUS (v.8.6) fence-agents-4.2.1-89.el8_6.22, fence-agents-all-4.2.1-89.el8_6.22, fence-agents-amt-ws-4.2.1-89.el8_6.22 +40
- Red Hat Enterprise Linux High Availability E4S (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.22, fence-agents-aws-4.2.1-89.el8_6.22, fence-agents-azure-arm-4.2.1-89.el8_6.22 +1
- Red Hat Enterprise Linux High Availability TUS (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.22, fence-agents-aws-4.2.1-89.el8_6.22, fence-agents-azure-arm-4.2.1-89.el8_6.22 +1
- RHSA-2026:22135 Released 2026-06-01 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents-4.2.1-65.el8_4.28, fence-agents-all-4.2.1-65.el8_4.28, fence-agents-amt-ws-4.2.1-65.el8_4.28 +40
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) fence-agents-4.2.1-65.el8_4.28, fence-agents-all-4.2.1-65.el8_4.28, fence-agents-amt-ws-4.2.1-65.el8_4.28 +36
- Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.28, fence-agents-aws-4.2.1-65.el8_4.28, fence-agents-azure-arm-4.2.1-65.el8_4.28 +1
- Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.28, fence-agents-aws-4.2.1-65.el8_4.28, fence-agents-azure-arm-4.2.1-65.el8_4.28 +1
- RHSA-2026:22132 Released 2026-06-01 · Red Hat rating Importantresource-agents security update
- Red Hat Enterprise Linux High Availability E4S (v.8.6) resource-agents-4.9.0-16.el8_6.22, resource-agents-aliyun-4.9.0-16.el8_6.22, resource-agents-gcp-4.9.0-16.el8_6.22 +1
- Red Hat Enterprise Linux High Availability TUS (v.8.6) resource-agents-4.9.0-16.el8_6.22, resource-agents-aliyun-4.9.0-16.el8_6.22, resource-agents-gcp-4.9.0-16.el8_6.22 +1
- RHSA-2026:22131 Released 2026-06-01 · Red Hat rating Importantresource-agents security update
- Red Hat Enterprise Linux High Availability E4S (v.8.8) resource-agents-4.9.0-40.el8_8.19, resource-agents-aliyun-4.9.0-40.el8_8.19, resource-agents-gcp-4.9.0-40.el8_8.19 +1
- Red Hat Enterprise Linux High Availability TUS (v.8.8) resource-agents-4.9.0-40.el8_8.19, resource-agents-aliyun-4.9.0-40.el8_8.19, resource-agents-gcp-4.9.0-40.el8_8.19 +1
- RHSA-2026:22133 Released 2026-06-01 · Red Hat rating Importantresource-agents security update
- Red Hat Enterprise Linux High Availability AUS (v.8.4) resource-agents-4.1.1-90.el8_4.25, resource-agents-aliyun-4.1.1-90.el8_4.25, resource-agents-gcp-4.1.1-90.el8_4.25
- Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) resource-agents-4.1.1-90.el8_4.25, resource-agents-aliyun-4.1.1-90.el8_4.25, resource-agents-gcp-4.1.1-90.el8_4.25
- RHSA-2026:20588 Released 2026-05-26 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) fence-agents-4.2.1-112.el8_8.17, fence-agents-all-4.2.1-112.el8_8.17, fence-agents-amt-ws-4.2.1-112.el8_8.17 +40
- Red Hat Enterprise Linux AppStream TUS (v.8.8) fence-agents-4.2.1-112.el8_8.17, fence-agents-all-4.2.1-112.el8_8.17, fence-agents-amt-ws-4.2.1-112.el8_8.17 +39
- Red Hat Enterprise Linux High Availability E4S (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.17, fence-agents-aws-4.2.1-112.el8_8.17, fence-agents-azure-arm-4.2.1-112.el8_8.17 +2
- Red Hat Enterprise Linux High Availability TUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.17, fence-agents-aws-4.2.1-112.el8_8.17, fence-agents-azure-arm-4.2.1-112.el8_8.17 +2
- RHSA-2026:19712 Released 2026-05-20 · Red Hat rating CriticalRHOAI 3.3.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
- RHSA-2026:19355 Released 2026-05-19 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-110.el9_8.2, fence-agents-aliyun-4.10.0-110.el9_8.2, fence-agents-all-4.10.0-110.el9_8.2 +47
- RHSA-2026:19375 Released 2026-05-19 · Red Hat rating ImportantRed Hat Quay 3.16.4
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:19138 Released 2026-05-19 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream (v. 10) fence-agents-4.16.0-21.el10_2.1, fence-agents-aliyun-4.16.0-21.el10_2.1, fence-agents-all-4.16.0-21.el10_2.1 +47
- RHSA-2026:17611 Released 2026-05-14 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.3
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:17083 Released 2026-05-13 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) fence-agents-4.16.0-5.el10_0.9, fence-agents-aliyun-4.16.0-5.el10_0.9, fence-agents-all-4.16.0-5.el10_0.9 +47
- RHSA-2026:16009 Released 2026-05-11 · Red Hat rating ImportantRed Hat AI Inference Server 3.3.3 (ROCm)
- Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
- RHSA-2026:14020 Released 2026-05-06 · Red Hat rating ImportantRelease of components for Service Telemetry Framework 1.5.7
- Red Hat OpenStack 1.5 registry.redhat.io/stf/prometheus-webhook-snmp-rhel9, registry.redhat.io/stf/service-telemetry-rhel9-operator, registry.redhat.io/stf/sg-core-rhel9 +1
- RHSA-2026:13917 Released 2026-05-06 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-98.el9_7.13, fence-agents-aliyun-4.10.0-98.el9_7.13, fence-agents-all-4.10.0-98.el9_7.13 +47
- RHSA-2026:13916 Released 2026-05-06 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream (v. 10) fence-agents-4.16.0-13.el10_1.4, fence-agents-aliyun-4.16.0-13.el10_1.4, fence-agents-all-4.16.0-13.el10_1.4 +47
- RHSA-2026:13902 Released 2026-05-06 · Red Hat rating Importantresource-agents security update
- Red Hat Enterprise Linux HighAvailability (v. 8) resource-agents-4.9.0-54.el8_10.33, resource-agents-aliyun-4.9.0-54.el8_10.33, resource-agents-gcp-4.9.0-54.el8_10.33 +1
- Red Hat Enterprise Linux ResilientStorage (v. 8) resource-agents-4.9.0-54.el8_10.33, resource-agents-aliyun-4.9.0-54.el8_10.33, resource-agents-gcp-4.9.0-54.el8_10.33 +1
- RHSA-2026:13553 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8, registry.redhat.io/ansible-automation-platform-25/gateway-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +2
- RHSA-2026:13545 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9 +11
- RHSA-2026:13512 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.28-3.el8ap, automation-gateway-proxy-2.5.10-5.el8ap, automation-gateway-proxy-server-2.5.10-5.el8ap +19
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.28-3.el9ap, automation-gateway-proxy-2.6.14-2.el9, automation-gateway-proxy-server-2.6.14-2.el9 +19
- RHSA-2026:13508 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.4-3.el10ap, receptorctl-1.6.4-3.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.11-2.el9ap, automation-controller-cli-4.7.11-2.el9ap, automation-controller-server-4.7.11-2.el9ap +25
- RHSA-2026:12176 Released 2026-04-30 · Red Hat rating Importantfence-agents security update
- Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-129.el8_10.25, fence-agents-all-4.2.1-129.el8_10.25, fence-agents-amt-ws-4.2.1-129.el8_10.25 +41
- Red Hat Enterprise Linux HighAvailability (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.25, fence-agents-aws-4.2.1-129.el8_10.25, fence-agents-azure-arm-4.2.1-129.el8_10.25 +2
- Red Hat Enterprise Linux ResilientStorage (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.25, fence-agents-aws-4.2.1-129.el8_10.25, fence-agents-azure-arm-4.2.1-129.el8_10.25 +2
- RHSA-2026:10184 Released 2026-04-23 · Red Hat rating ImportantRHOAI 2.25.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:8437 Released 2026-04-16 · Red Hat rating ImportantRHTAS 1.4 - GA Release of Model Transparency
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-rhel9
- RHSA-2026:6926 Released 2026-04-07 · Red Hat rating ImportantRed Hat Quay 3.9.20
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:6912 Released 2026-04-07 · Red Hat rating ImportantRed Hat Quay 3.10.20
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:6720 Released 2026-04-06 · Red Hat rating ImportantRed Hat Quay 3.12.16
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:6568 Released 2026-04-03 · Red Hat rating ImportantRed Hat Quay 3.15.4
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:6404 Released 2026-04-01 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/hub-rhel9, registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9 +2
- RHSA-2026:6309 Released 2026-03-31 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/hub-rhel9, registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9 +2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix planned: Will not fix |
| OpenShift Lightspeed | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Red Hat AI Inference Server 3.3 | Fixed | RHSA-2026:16009 |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2026:13553 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:13512, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:13512, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:13545, RHSA-2026:6309 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:13508, RHSA-2026:24762 |
| Red Hat Enterprise Linux AI 3.3 | Fixed | RHSA-2026:17611 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:13916, RHSA-2026:19138 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:12176 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:13917, RHSA-2026:19355 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2026:22135 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:22134 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2026:22134 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:20588 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:22987 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:22969 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:17083 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:22970 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:22135 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2026:22134 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:20588 |
| Red Hat Enterprise Linux High Availability AUS (v.8.4) | Fixed | RHSA-2026:22133, RHSA-2026:22135 |
| Red Hat Enterprise Linux High Availability E4S (v.8.6) | Fixed | RHSA-2026:22132, RHSA-2026:22134 |
| Red Hat Enterprise Linux High Availability E4S (v.8.8) | Fixed | RHSA-2026:20588, RHSA-2026:22131 |
| Red Hat Enterprise Linux High Availability E4S (v.9.2) | Fixed | RHSA-2026:22987 |
| Red Hat Enterprise Linux High Availability E4S (v.9.4) | Fixed | RHSA-2026:22969 |
| Red Hat Enterprise Linux High Availability TUS (v.8.6) | Fixed | RHSA-2026:22132, RHSA-2026:22134 |
| Red Hat Enterprise Linux High Availability TUS (v.8.8) | Fixed | RHSA-2026:20588, RHSA-2026:22131 |
| Red Hat Enterprise Linux HighAvailability (v. 8) | Fixed | RHSA-2026:12176, RHSA-2026:13902 |
| Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:22133, RHSA-2026:22135 |
| Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) | Fixed | RHSA-2026:22987 |
| Red Hat Enterprise Linux Resilient Storage E4S (v.9.4) | Fixed | RHSA-2026:22969 |
| Red Hat Enterprise Linux ResilientStorage (v. 8) | Fixed | RHSA-2026:12176, RHSA-2026:13902 |
| Red Hat Migration Toolkit 1.8 | Fixed | RHSA-2026:41928 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:10184, RHSA-2026:65126 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:19712, RHSA-2026:37275 |
| Red Hat OpenStack 1.5 | Fixed | RHSA-2026:14020 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:6912 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:6720 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:6568 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:19375 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:6926 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:8437 |
Not affected: 20 products
- OpenShift Service Mesh 3
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Enterprise Linux AI 3.3
- Red Hat Migration Toolkit 1.8
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenStack 1.5
- Red Hat OpenStack Platform 18.0
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-30922
- 2026-10-03 Alias added: GHSA-jr27-m4p2-rc6r
References
Other 46
- https://github.com/pyasn1/pyasn1/commit/5a49bd1fe93b5b866a1210f6bf0a3924f21572c8
- https://access.redhat.com/errata/RHSA-2026:22970
- https://access.redhat.com/errata/RHSA-2026:22987
- https://access.redhat.com/errata/RHSA-2026:24761
- https://access.redhat.com/errata/RHSA-2026:24762
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:6309
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:6568
- https://access.redhat.com/errata/RHSA-2026:6720
- https://access.redhat.com/errata/RHSA-2026:6912
- https://access.redhat.com/errata/RHSA-2026:6926
- https://access.redhat.com/errata/RHSA-2026:8437
- https://access.redhat.com/security/cve/CVE-2026-30922
- https://bugzilla.redhat.com/show_bug.cgi?id=2448553
- https://github.com/pyasn1/pyasn1
- https://github.com/pyasn1/pyasn1/releases/tag/v0.6.3
- https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-2263.yaml
- https://lists.debian.org/debian-lts-announce/2026/05/msg00001.html
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-30922.json
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:12176
- https://access.redhat.com/errata/RHSA-2026:13508
- https://access.redhat.com/errata/RHSA-2026:13512
- https://access.redhat.com/errata/RHSA-2026:13545
- https://access.redhat.com/errata/RHSA-2026:13553
- https://access.redhat.com/errata/RHSA-2026:13902
- https://access.redhat.com/errata/RHSA-2026:13916
- https://access.redhat.com/errata/RHSA-2026:13917
- https://access.redhat.com/errata/RHSA-2026:14020
- https://access.redhat.com/errata/RHSA-2026:16009
- https://access.redhat.com/errata/RHSA-2026:17083
- https://access.redhat.com/errata/RHSA-2026:17611
- https://access.redhat.com/errata/RHSA-2026:19138
- https://access.redhat.com/errata/RHSA-2026:19355
- https://access.redhat.com/errata/RHSA-2026:19375
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:20588
- https://access.redhat.com/errata/RHSA-2026:22131
- https://access.redhat.com/errata/RHSA-2026:22132
- https://access.redhat.com/errata/RHSA-2026:22133
- https://access.redhat.com/errata/RHSA-2026:22134
- https://access.redhat.com/errata/RHSA-2026:22135
- https://access.redhat.com/errata/RHSA-2026:22969
- http://www.openwall.com/lists/oss-security/2026/03/20/4
More Pyasn1 vulnerabilities
- TI-2026-18923 pyasn1 has a DoS vulnerability in decoder CVSS 3.1HIGH 7.5
- TI-2026-42699 pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service CVSS 3.1HIGH 7.5
- TI-2026-42698 pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs CVSS 3.1HIGH 7.5
- TI-2026-42700 pyasn1: Uncontrolled resource consumption when converting decoded REAL values CVSS 3.1HIGH 7.5
Sources
- CVE-2026-30922 · CVE Program
- CVE-2026-30922 · NVD
- FIRST EPSS
- GHSA-jr27-m4p2-rc6r · GitHub Advisory Database · CC BY 4.0
- CVE-2026-30922 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences