UBUNTU-CVE-2026-128238: Medium severity ubuntu/scapy vulnerability
Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Applications that use Scapy's BER/ASN.1 decoder to parse attacker-controlled TLS, SNMP, X.509, or LDAP data are exposed. The affected software is Scapy before version 2.8.0.
What does an attacker need to exploit it?
An unauthenticated remote attacker only needs to deliver a crafted ASN.1 payload to a reachable parsing application. A single 833-byte packet containing 250 nested ASN.1 SEQUENCE structures can trigger the failure.
Does enabling safe=True prevent the crash?
No. The recursion failure can terminate affected parsers even when safe=True is enabled.
What is the impact of successful exploitation?
Successful exploitation triggers an unhandled RecursionError and crashes the parsing application, causing a denial of service. The provided severity vector indicates no confidentiality or integrity impact.