Update dependency pyasn1 to v0.6.3 [SECURITY] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pyasn1 (changelog)	==0.6.0 → ==0.6.3

---

Denial of Service in pyasn1 via Unbounded Recursion

CVE-2026-30922 / GHSA-jr27-m4p2-rc6r

More information

Details

Summary

The pyasn1 library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.

Details

The vulnerability exists because the decoder iterates through the input stream and recursively calls decodeFun (the decoding callback) for every nested component found, without tracking or limiting the recursion depth.
Vulnerable Code Locations:

1. indefLenValueDecoder (Line 998):
   for component in decodeFun(substrate, asn1Spec, allowEoo=True, **options):
   This method handles indefinite-length constructed types. It sits inside a while True loop and recursively calls the decoder for every nested tag.

2. valueDecoder (Lines 786 and 907):
   for component in decodeFun(substrate, componentType, **options):
   This method handles standard decoding when a schema is present. It contains two distinct recursive calls that lack depth checks: Line 786: Recursively decodes components of SEQUENCE or SET types. Line 907: Recursively decodes elements of SEQUENCE OF or SET OF types.

3. _decodeComponentsSchemaless (Line 661):
   for component in decodeFun(substrate, **options):
   This method handles decoding when no schema is provided.

In all three cases, decodeFun is invoked without passing a depth parameter or checking against a global MAX_ASN1_NESTING limit.

PoC

import sys
from pyasn1.codec.ber import decoder

sys.setrecursionlimit(100000)

print("[*] Generating Recursion Bomb Payload...")
depth = 50_000
chunk = b'\x30\x80' 
payload = chunk * depth

print(f"[*] Payload size: {len(payload) / 1024:.2f} KB")
print("[*] Triggering Decoder...")

try:
    decoder.decode(payload)
except RecursionError:
    print("[!] Crashed: Recursion Limit Hit")
except MemoryError:
    print("[!] Crashed: Out of Memory")
except Exception as e:
    print(f"[!] Crashed: {e}")

[*] Payload size: 9.77 KB
[*] Triggering Decoder...
[!] Crashed: Recursion Limit Hit

Impact

• This is an unhandled runtime exception that typically terminates the worker process or thread handling the request. This allows a remote attacker to trivially kill service workers with a small payload (<100KB), resulting in a Denial of Service. Furthermore, in environments where recursion limits are increased, this leads to server-wide memory exhaustion.
• Service Crash: Any service using pyasn1 to parse untrusted ASN.1 data (e.g., LDAP, SNMP, Kerberos, X.509 parsers) can be crashed remotely.
• Resource Exhaustion: The attack consumes RAM linearly with the nesting depth. A small payload (<200KB) can consume hundreds of megabytes of RAM or exhaust the stack.

Credits

Vulnerability discovered by Kevin Tu of TMIR at ByteDance.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r
• https://github.com/pyasn1/pyasn1/commit/5a49bd1fe93b5b866a1210f6bf0a3924f21572c8
• https://github.com/pyasn1/pyasn1/releases/tag/v0.6.3
• https://nvd.nist.gov/vuln/detail/CVE-2026-30922
• https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0
• http://www.openwall.com/lists/oss-security/2026/03/20/4
• https://github.com/advisories/GHSA-jr27-m4p2-rc6r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pyasn1/pyasn1 (pyasn1)

v0.6.3

Compare Source

• CVE-2026-30922 (GHSA-jr27-m4p2-rc6r): Added nesting depth
  limit to ASN.1 decoder to prevent stack overflow from deeply
  nested structures (thanks for reporting, romanticpragmatism)
• Fixed OverflowError from oversized BER length field
  issue #​54
  pr #​100
• Fixed DeprecationWarning stacklevel for deprecated attributes
  issue #​86
  pr #​101
• Fixed asDateTime incorrect fractional seconds parsing
  issue #​81
  pr #​102

v0.6.2

Compare Source

• CVE-2026-23490 (GHSA-63vm-454h-vhhq): Fixed continuation octet limits
  in OID/RELATIVE-OID decoder (thanks to tsigouris007)
• Added support for Python 3.14
  pr #​97
• Added SECURITY.md policy
• Fixed unit tests failing due to missing code
  issue #​91
  pr #​92
• Migrated to pyproject.toml packaging
  pr #​90

v0.6.1

Compare Source

• Added support for Python 3.13 and updated GitHub Actions
  pr #​73
• Removed Python 2 support and related code
  pr #​62
  pr #​61
  pr #​60
• Improved error handling and consistency
  pr #​71
  pr #​70
• Runtime deprecation of tagMap and typeMap aliases
  pr #​72
• Fixed duplicated and missing declarations
  pr #​64
• Cleaned documentation and comments
  pr #​63
• Removed bdist_wheel universal flag from setup.cfg
  pr #​69

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud