Loading story…
A high-severity denial-of-service vulnerability tracked as CVE-2026-30922 was disclosed in the Python pyasn1 package, where uncontrolled recursion during ASN.1 decoding can crash applications or exhaust memory. The flaw affects pyasn1 0.6.2 and earlier and was fixed in 0.6.3. According to the advisory, crafted ASN.1 input with deeply nested SEQUENCE or SET tags and indefinite-length markers can trigger RecursionError exceptions or out-of-memory conditions during decoding.
The issue stems from recursive decoder paths that do not enforce a recursion-depth limit, including indefinite-length decoding as well as schema-based and schemaless decoding. Services that parse untrusted ASN.1 data may be remotely exposed, including software handling LDAP, SNMP, Kerberos, and X.509 data. The vulnerability is classified as CWE-674 and carries a CVSS 3.0 score of 7.5; the issue was reported by Kevin Tu of TMIR at ByteDance and documented in both the upstream GitHub security advisory and the oss-security disclosure.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
An oss-sec post publicly disclosed CVE-2026-30922 and provided technical details on multiple affected decoder code paths, including indefinite-length, schema-based, and schemaless decoding. The disclosure noted that remotely reachable services such as LDAP, SNMP, Kerberos, and X.509 parsers may be exposed if they rely on pyasn1.
The vulnerability was fixed in pyasn1 version 0.6.3, which addressed recursive decoder paths that lacked recursion-depth limits. The fix mitigates crashes and out-of-memory conditions triggered by crafted nested ASN.1 data.
A GitHub security advisory was published for CVE-2026-30922, describing a high-severity denial-of-service vulnerability in pyasn1 via unbounded recursion. The advisory identifies the flaw as affecting pyasn1 through version 0.6.2.
Kevin Tu of TMIR at ByteDance reported a denial-of-service flaw in pyasn1 caused by uncontrolled recursion during ASN.1 decoding of deeply nested structures. The issue affects pyasn1 0.6.2 and earlier and can crash or exhaust memory in services parsing untrusted ASN.1 data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed a high-severity denial-of-service flaw in its **X.509IF protocol dissector** that can cause both Wireshark and TShark to crash while dissecting malformed traffic or packet capture files. The bug, assigned **`CVE-2026-76928`**, stems from nested `DistinguishedName` decoding that corrupts DN/RDN formatting state and leads to a **NULL pointer dereference** in generated X.509IF parsing code using file-static state such as `last_rdn_buf`. Researchers from **Aisle Research, O2Lab, and TAMU** reported that the crash can be triggered by a crafted LDAP `ExtendedRequest` carrying a nested `id-at-member` value (`OID 2.5.4.31`), without authentication, a bind, a TCP session, or cryptographic validation. Wireshark maintainers reproduced the issue, confirmed it as a regression, and released fixes that preserve parser state across nested decoding and exception unwinds; affected versions include **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, with patches available in **4.6.8** and **4.4.18**.
Aug 21, 2026
Apache disclosed **CVE-2026-71558**, a heap type confusion flaw in Apache Fory's C++ deserialization logic that affects versions `0.14.0` through versions before `1.5.0`. The vulnerability is triggered by a crafted input payload during polymorphic smart-pointer deserialization, allowing type compatibility checks to be bypassed so an incompatible object can be treated as the declared base type. Apache and downstream advisories warn that successful exploitation can cause undefined behavior and may lead to denial of service or **arbitrary code execution**. The issue is tracked as **CWE-502** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating a network-exploitable flaw with high impact across confidentiality, integrity, and availability. Apache said applications that do not use Fory C++ polymorphic smart-pointer deserialization are not affected, and recommended upgrading to **Apache Fory `1.5.0`**, which fixes the bug. The vulnerability was reported by independent security researcher **Zhixi "Jace" Sun**, while CISA SSVC metadata listed exploitation as none observed, automatable as yes, and technical impact as total.
Aug 7, 2026
Erlang/OTP users were urged to patch after multiple vulnerabilities were disclosed across the platform, including high-severity flaws that can crash BEAM nodes or exhaust resources during normal protocol handling. **CVE-2026-59251** affects `public_key` certificate path validation, where a crafted X.509 chain can trigger exponential certificate policy tree growth during a TLS handshake and consume CPU and memory until the VM fails. **CVE-2026-58227** affects the `ssl` application, where mutually cross-signed certificates can cause unbounded recursion while rebuilding incomplete TLS or DTLS peer chains, allowing an unauthenticated attacker to crash either servers or clients before authentication completes. A separate high-severity flaw, **CVE-2026-54890**, impacts the `erts` External Term Format decoder used by `binary_to_term/1`, `binary_to_term/2`, and `enif_binary_to_term()`, where an integer underflow in `BIT_BINARY_EXT` decoding can trigger near-`2^64` memory allocation and terminate the entire Erlang VM. National cyber authorities in Canada and Italy published advisories directing administrators to review Erlang security bulletins and update affected releases, while the Italian notice said the broader disclosure set includes additional Erlang/OTP issues spanning denial of service, remote code execution, authentication bypass, and security feature bypass. Fixed versions cited across the disclosures include **27.3.4.15**, **28.5.0.4**, and **29.0.4**.
Jul 29, 2026