{"id":"CVE-2026-128238","kind":"vulnerability","aliases":["CVE-2026-128238"],"related":[],"title":"Scapy: nested ASN.1 packet crashes BER parsers via unbounded recursion","description":"Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.","summary":"Scapy's BER/ASN.1 decoder recurses without a limit, so a single crafted packet with 250 nested SEQUENCE structures raises an unhandled RecursionError. An unauthenticated remote attacker can crash any application that parses TLS, SNMP, X.509 or LDAP data through Scapy.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["network-tools","package","python","scapy"],"not_affected_if":["no-untrusted-input","scapy-not-used"],"how_to_check":"- Check the installed Scapy version with `pip show scapy` or `python -c \"import scapy; print(scapy.VERSION)\"`, and treat anything below `2.8.0` as affected.\n- Search dependencies for `scapy` in requirements files, lock files or the output of `pip freeze`.\n- Confirm whether your code feeds untrusted network data into Scapy's ASN.1 or BER decoding.","fix":"- Scapy: upgrade to `2.8.0` or later.","status":"open","published_at":"2026-11-13T10:18:11+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","triaged_at":"2026-11-13T10:54:31+00:00","updated_at":"2026-11-13T10:54:31+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:54:31Z","model":"claude-haiku-5-5","output":{"fix":"- Scapy: upgrade to `2.8.0` or later.","reach":"network","title":"Scapy: nested ASN.1 packet crashes BER parsers via unbounded recursion","impact":"low","summary":"Scapy's BER/ASN.1 decoder recurses without a limit, so a single crafted packet with 250 nested SEQUENCE structures raises an unhandled RecursionError. An unauthenticated remote attacker can crash any application that parses TLS, SNMP, X.509 or LDAP data through Scapy.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","scapy","network-tools"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Parsing process crashes on one malicious packet, causing denial of service.","analyst_note":"Confirm from the vendor advisory (github.com) and VulnCheck advisory whether safe=True mitigates the crash and whether any non-2.8.0 fix exists.","how_to_check":"- Check the installed Scapy version with `pip show scapy` or `python -c \"import scapy; print(scapy.VERSION)\"`, and treat anything below `2.8.0` as affected.\n- Search dependencies for `scapy` in requirements files, lock files or the output of `pip freeze`.\n- Confirm whether your code feeds untrusted network data into Scapy's ASN.1 or BER decoding.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-input","scapy-not-used"],"who_is_affected":"Applications that use Scapy's ASN.1/BER decoder on packets from untrusted networks, such as TLS, SNMP, X.509 or LDAP parsing, are exposed. Projects that only use Scapy offline on trusted captures or never decode ASN.1 from the network can likely skip it. The sources do not say whether the crash can be avoided through the safe=True option, beyond noting that it does not prevent the crash.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000828,"input_tokens":4673,"output_tokens":722,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128238':13A,16A '-2026':12A,15A '2.8.0':65C '250':37B,95C '833':91C 'allow':78C 'applic':52B,85C 'asn.1':3A,97C 'attack':48B,81C,86C 'ber':6A 'ber/asn.1':25B,73C 'byte':92C 'contain':66C 'craft':34B 'crash':5A,50B,83C 'cve':11A,14A 'data':60B 'decod':26B,74C 'even':112C 'ldap':59B,110C 'limit':30B 'nest':2A,38B,96C 'network':18B 'network-tool':17B 'packag':20B 'packet':4A,35B,93C 'pars':54B,84C 'parser':7A,111C 'python':21B 'rais':41B 'recurs':10A,27B,69C 'recursionerror':44B,104C 'remot':47B,80C 'safe':114C 'scapi':1A,22B,23B,62B,63C 'scapy/asn1/ber.py':76C 'send':88C 'sequenc':39B,98C 'singl':33B,90C 'snmp':56B,107C 'structur':40B,99C 'termin':105C 'tls':55B,106C 'tool':19B 'trigger':101C 'true':115C 'unauthent':46B,79C 'unbound':9A 'uncontrol':68C 'unhandl':43B,103C 'via':8A 'vulner':70C 'without':28B 'x.509':57B,108C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Scapy's ASN.1/BER decoder on packets from untrusted networks, such as TLS, SNMP, X.509 or LDAP parsing, are exposed. Projects that only use Scapy offline on trusted captures or never decode ASN.1 from the network can likely skip it. The sources do not say whether the crash can be avoided through the safe=True option, beyond noting that it does not prevent the crash.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","networktools","package","python","scapy"],"campaign_type":null,"search_a":"'-128238':13A,16A '-2026':12A,15A 'asn.1':3A 'ber':6A 'crash':5A 'cve':11A,14A 'nest':2A 'packet':4A 'parser':7A 'recurs':10A 'scapi':1A 'unbound':9A 'via':8A","search_b":"'250':37B 'applic':52B 'attack':48B 'ber/asn.1':25B 'craft':34B 'crash':50B 'data':60B 'decod':26B 'ldap':59B 'limit':30B 'nest':38B 'network':18B 'network-tool':17B 'packag':20B 'packet':35B 'pars':54B 'python':21B 'rais':41B 'recurs':27B 'recursionerror':44B 'remot':47B 'scapi':22B,23B,62B 'sequenc':39B 'singl':33B 'snmp':56B 'structur':40B 'tls':55B 'tool':19B 'unauthent':46B 'unhandl':43B 'without':28B 'x.509':57B","search_c":"'2.8.0':65C '250':95C '833':91C 'allow':78C 'applic':85C 'asn.1':97C 'attack':81C,86C 'ber/asn.1':73C 'byte':92C 'contain':66C 'crash':83C 'decod':74C 'even':112C 'ldap':110C 'nest':96C 'packet':93C 'pars':84C 'parser':111C 'recurs':69C 'recursionerror':104C 'remot':80C 'safe':114C 'scapi':63C 'scapy/asn1/ber.py':76C 'send':88C 'sequenc':98C 'singl':90C 'snmp':107C 'structur':99C 'termin':105C 'tls':106C 'trigger':101C 'true':115C 'unauthent':79C 'uncontrol':68C 'unhandl':103C 'vulner':70C 'x.509':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-08T22:46:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128238","severity":null,"published_at":"2026-11-13T10:18:11+00:00","modified_at":"2026-11-13T10:18:11+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","fetched_at":"2026-11-13T10:47:33+00:00","note":null}],"documents":[{"id":145426,"url":"https://github.com/secdev/scapy/security/advisories/GHSA-456h-w4v7-hvpr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-08T22:46:44+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145427,"url":"https://www.vulncheck.com/advisories/scapy-before-2.8.0-uncontrolled-recursion-dos-via-ber-sequence-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}