CVE-2026-128237: Scapy before 2.8.0 Denial of Service via Quadratic BER OID Decoding
Scapy before 2.8.0 contains a denial of service vulnerability in BERnumdec() and BERcodecOID.dodec() that allows remote attackers to exhaust CPU by supplying oversized OID arcs. Attackers can send ASN.1/BER data with many base-128 continuation bytes to cause quadratic CPU consumption or an uncaught ValueError crash on Python 3.11+.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Scapy before 2.8.0 that decode attacker-controlled ASN.1/BER data are exposed. The vulnerable decoding paths are BER_num_dec() and BERcodec_OID.do_dec().
What does an attacker need to send to trigger the denial of service?
An attacker can supply ASN.1/BER data containing oversized OID arcs with many base-128 continuation bytes. No privileges or user interaction are required according to the supplied severity vector.
What is the impact on Python 3.11 and later?
In addition to quadratic CPU consumption, malformed oversized OID arcs can cause an uncaught ValueError crash on Python 3.11 and later.
How can I determine whether an installation is affected?
Check the installed Scapy version and whether it is earlier than 2.8.0. Also identify whether the application processes untrusted ASN.1/BER input through Scapy's OID decoding functionality.