{"id":"CVE-2026-128237","kind":"vulnerability","aliases":["CVE-2026-128237"],"related":[],"title":"Scapy: oversized BER OID input exhausts CPU and crashes parsing","description":"Scapy before 2.8.0 contains a denial of service vulnerability in BER_num_dec() and BERcodec_OID.do_dec() that allows remote attackers to exhaust CPU by supplying oversized OID arcs. Attackers can send ASN.1/BER data with many base-128 continuation bytes to cause quadratic CPU consumption or an uncaught ValueError crash on Python 3.11+.","summary":"Scapy versions before 2.8.0 mishandle ASN.1/BER data with many base-128 continuation bytes in OID arcs. A remote attacker can send such data to consume CPU or crash the process with an uncaught ValueError on Python 3.11 and later.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["network-tooling","package","python","scapy"],"not_affected_if":["no-untrusted-ber-input","scapy-2.8.0-or-later"],"how_to_check":"- Run `pip show scapy` and check whether the version is below `2.8.0`\n- Look for projects that parse untrusted BER or SNMP/LDAP-style ASN.1 data with Scapy","fix":"- Scapy: move to `2.8.0` or later","status":"open","published_at":"2026-11-13T10:18:11+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","triaged_at":"2026-11-13T10:54:31+00:00","updated_at":"2026-11-13T10:54:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:54:31Z","model":"claude-haiku-5-5","output":{"fix":"- Scapy: move to `2.8.0` or later","reach":"network","title":"Scapy: oversized BER OID input exhausts CPU and crashes parsing","impact":"low","summary":"Scapy versions before 2.8.0 mishandle ASN.1/BER data with many base-128 continuation bytes in OID arcs. A remote attacker can send such data to consume CPU or crash the process with an uncaught ValueError on Python 3.11 and later.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","scapy","network-tooling"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker exhausts CPU or crashes the parsing process","analyst_note":"","how_to_check":"- Run `pip show scapy` and check whether the version is below `2.8.0`\n- Look for projects that parse untrusted BER or SNMP/LDAP-style ASN.1 data with Scapy","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-ber-input","scapy-2.8.0-or-later"],"who_is_affected":"Teams whose code uses Scapy to decode ASN.1/BER data from untrusted network traffic are exposed, because the flaw is in the BER decoding path. Scripts that only craft packets for lab work on trusted networks, or that never parse inbound BER, are unlikely to be reached.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000731,"input_tokens":4645,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128':33B,98C '-128237':13A,16A '-2026':12A,15A '2.8.0':26B,64C '3.11':59B,113C 'allow':79C 'arc':38B,89C 'asn.1/ber':28B,93C 'attack':41B,81C,90C 'base':32B,97C 'ber':3A,72C 'bercodec_oid.do':76C 'byte':35B,100C 'caus':102C 'consum':47B 'consumpt':105C 'contain':65C 'continu':34B,99C 'cpu':7A,48B,84C,104C 'crash':9A,50B,110C 'cve':11A,14A 'data':29B,45B,94C 'dec':74C,77C 'denial':67C 'exhaust':6A,83C 'input':5A 'later':61B 'mani':31B,96C 'mishandl':27B 'network':18B 'network-tool':17B 'num':73C 'oid':4A,37B,88C 'overs':2A,87C 'packag':20B 'pars':10A 'process':52B 'python':21B,58B,112C 'quadrat':103C 'remot':40B,80C 'scapi':1A,22B,23B,62C 'send':43B,92C 'servic':69C 'suppli':86C 'tool':19B 'uncaught':55B,108C 'valueerror':56B,109C 'version':24B 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Teams whose code uses Scapy to decode ASN.1/BER data from untrusted network traffic are exposed, because the flaw is in the BER decoding path. Scripts that only craft packets for lab work on trusted networks, or that never parse inbound BER, are unlikely to be reached.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","networktooling","package","python","scapy"],"campaign_type":null,"search_a":"'-128237':13A,16A '-2026':12A,15A 'ber':3A 'cpu':7A 'crash':9A 'cve':11A,14A 'exhaust':6A 'input':5A 'oid':4A 'overs':2A 'pars':10A 'scapi':1A","search_b":"'-128':33B '2.8.0':26B '3.11':59B 'arc':38B 'asn.1/ber':28B 'attack':41B 'base':32B 'byte':35B 'consum':47B 'continu':34B 'cpu':48B 'crash':50B 'data':29B,45B 'later':61B 'mani':31B 'mishandl':27B 'network':18B 'network-tool':17B 'oid':37B 'packag':20B 'process':52B 'python':21B,58B 'remot':40B 'scapi':22B,23B 'send':43B 'tool':19B 'uncaught':55B 'valueerror':56B 'version':24B","search_c":"'-128':98C '2.8.0':64C '3.11':113C 'allow':79C 'arc':89C 'asn.1/ber':93C 'attack':81C,90C 'base':97C 'ber':72C 'bercodec_oid.do':76C 'byte':100C 'caus':102C 'consumpt':105C 'contain':65C 'continu':99C 'cpu':84C,104C 'crash':110C 'data':94C 'dec':74C,77C 'denial':67C 'exhaust':83C 'mani':96C 'num':73C 'oid':88C 'overs':87C 'python':112C 'quadrat':103C 'remot':80C 'scapi':62C 'send':92C 'servic':69C 'suppli':86C 'uncaught':108C 'valueerror':109C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-08T22:47:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128237","severity":null,"published_at":"2026-11-13T10:18:11+00:00","modified_at":"2026-11-13T10:18:11+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","fetched_at":"2026-11-13T10:47:33+00:00","note":null}],"documents":[{"id":145424,"url":"https://github.com/secdev/scapy/security/advisories/GHSA-xx44-g48m-mjp6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-08T22:47:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145425,"url":"https://www.vulncheck.com/advisories/scapy-before-2.8.0-denial-of-service-via-quadratic-ber-oid-decoding","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}