CVE-2026-128237 · Package
NO FIX YET · SEE WHAT TO DO
Scapy versions before 2.8.0 mishandle ASN.1/BER data with many base-128 continuation bytes in OID arcs. A remote attacker can send such data to consume CPU or crash the process with an uncaught ValueError on Python 3.11 and later.
first public Sep 8, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams whose code uses Scapy to decode ASN.1/BER data from untrusted network traffic are exposed, because the flaw is in the BER decoding path. Scripts that only craft packets for lab work on trusted networks, or that never parse inbound BER, are unlikely to be reached.
Not affected if no-untrusted-ber-input, scapy-2.8.0-or-later
Who cares network-tooling, python, scapy
pip show scapy and check whether the version is below 2.8.02.8.0 or laterScapy before 2.8.0 contains a denial of service vulnerability in BER_num_dec() and BERcodec_OID.do_dec() that allows remote attackers to exhaust CPU by supplying oversized OID arcs. Attackers can send ASN.1/BER data with many base-128 continuation bytes to cause quadratic CPU consumption or an uncaught ValueError crash on Python 3.11+.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.