REDHAT-BUG-2448553: Integer Overflow
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the pyasn1 library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested SEQUENCE (0x30) or SET (0x31) tags with "Indefinite Length" (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (MAXOIDARCCONTINUATIONOCTETS) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pyasn1to a version that resolves this vulnerability.Fixed in 0.6.3
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2448553?
The severity of REDHAT-BUG-2448553 is high with a score of 7.
What can an attacker do with REDHAT-BUG-2448553?
An attacker can perform a Denial of Service (DoS) attack by exploiting uncontrolled recursion in the `pyasn1` library when decoding deeply nested ASN.1 data.
How do I fix REDHAT-BUG-2448553?
To fix REDHAT-BUG-2448553, upgrade the `pyasn1` library to version 0.6.3 or later.
What kind of vulnerability is REDHAT-BUG-2448553 classified as?
REDHAT-BUG-2448553 is classified as a Denial of Service (DoS) vulnerability due to uncontrolled recursion.
Which software is affected by REDHAT-BUG-2448553?
The affected software is the `pyasn1` library available on PyPI.