CVE-2026-128238: Scapy before 2.8.0 Uncontrolled Recursion DoS via BER SEQUENCE Decoder
Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using Scapy's BER/ASN.1 decoder to parse untrusted TLS, SNMP, X.509, or LDAP data are exposed. The issue can be triggered remotely without authentication.
Does enabling safe=True prevent exploitation?
No. The vulnerability can terminate affected parsers even when safe=True is enabled.
What does an attacker need to send?
An attacker can trigger the condition with a single 833-byte packet containing 250 nested ASN.1 SEQUENCE structures. No privileges or user interaction are required.
How can I determine whether an application is affected?
Check whether it uses Scapy versions before 2.8.0 and invokes the BER/ASN.1 decoder on attacker-controlled input. An affected parser may terminate with an unhandled RecursionError when processing deeply nested ASN.1 SEQUENCE data.