---
id: "CVE-2026-128238"
page: "https://infrastack.ai/live/CVE-2026-128238"
kind: "vulnerability"
aliases: ["CVE-2026-128238"]
title: "Scapy: nested ASN.1 packet crashes BER parsers via unbounded recursion"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["network-tools", "package", "python", "scapy"]
not_affected_if: ["no-untrusted-input", "scapy-not-used"]
published_at: "2026-11-13T10:18:11+00:00"
first_seen_at: "2026-11-13T10:47:33+00:00"
updated_at: "2026-11-13T10:54:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128238", "first_seen_at": "2026-11-13T10:47:33+00:00"}]
exploit_sources: []
---

# Scapy: nested ASN.1 packet crashes BER parsers via unbounded recursion

Link for people: https://infrastack.ai/live/CVE-2026-128238 (this .md is for agents)

Scapy's BER/ASN.1 decoder recurses without a limit, so a single crafted packet with 250 nested SEQUENCE structures raises an unhandled RecursionError. An unauthenticated remote attacker can crash any application that parses TLS, SNMP, X.509 or LDAP data through Scapy.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Scapy version with `pip show scapy` or `python -c "import scapy; print(scapy.VERSION)"`, and treat anything below `2.8.0` as affected.
- Search dependencies for `scapy` in requirements files, lock files or the output of `pip freeze`.
- Confirm whether your code feeds untrusted network data into Scapy's ASN.1 or BER decoding.

## Fix

- Scapy: upgrade to `2.8.0` or later.

## Timeline

- 2026-11-13T10:47:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128238

## Documents

- [advisory] Vendor advisory: github.com https://github.com/secdev/scapy/security/advisories/GHSA-456h-w4v7-hvpr
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/scapy-before-2.8.0-uncontrolled-recursion-dos-via-ber-sequence-decoder

## From the sources

Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_