fix(deps): bump pyasn1 to 0.6.4 for CVE-2026-30922 - #4197
Merged
Jan-Kazlouski-elastic merged 5 commits intoJul 17, 2026
Conversation
CVE-2026-30922 (High) is a DoS in pyasn1 < 0.6.3: the BER decoder has unbounded recursion when handling deeply nested indefinite-length SEQUENCE/SET structures, so a crafted ASN.1 payload can crash the worker via RecursionError/OOM. Raise the previous <0.6.1 cap (from PR #2817, which avoided a pyasn1 0.6.1 deprecation) to the latest patch release 0.6.4. pyasn1 0.6.1+ renamed the ber encoder/decoder tagMap/typeMap attributes to TAG_MAP/TYPE_MAP and left deprecating aliases. ldap3 2.9.1 (its last, now unmaintained release) still imports the old names, emitting a benign DeprecationWarning that our warnings-as-errors test config turns into a collection error. Ignore those two specific warnings so the bump passes. Closes elastic/security#12505 Co-authored-by: Cursor <cursoragent@cursor.com>
erikcurrin-elastic
approved these changes
Jul 17, 2026
Resolve pyproject.toml dependency conflict: keep pyOpenSSL==26.0.0 (from main #4203, CVE-2026-27459) and pyasn1==0.6.4 (this PR, CVE-2026-30922). The two pins are independent; msal==1.32.3 and cryptography 46.x come in cleanly from main. NOTICE.txt auto-merged. Co-authored-by: Cursor <cursoragent@cursor.com>
Jan-Kazlouski-elastic
enabled auto-merge (squash)
July 17, 2026 13:31
This was referenced Jul 17, 2026
💔 Failed to create backport PR(s)
Successful backport PRs will be merged automatically after passing CI. To backport manually run: |
Jan-Kazlouski-elastic
added a commit
that referenced
this pull request
Jul 17, 2026
Backports the following commits to 9.3: - fix(deps): bump pyasn1 to 0.6.4 for CVE-2026-30922 (#4197) Co-authored-by: Jan-Kazlouski-elastic <jan.kazlouski@elastic.co> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Jan-Kazlouski-elastic
added a commit
that referenced
this pull request
Jul 20, 2026
Backports the following commits to 9.5: - fix(deps): bump pyasn1 to 0.6.4 for CVE-2026-30922 (#4197) Co-authored-by: Jan-Kazlouski-elastic <jan.kazlouski@elastic.co> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Jan-Kazlouski-elastic
added a commit
that referenced
this pull request
Jul 20, 2026
Backports the following commits to 9.4: - fix(deps): bump pyasn1 to 0.6.4 for CVE-2026-30922 (#4197) Co-authored-by: Jan-Kazlouski-elastic <jan.kazlouski@elastic.co> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Jan-Kazlouski-elastic
added a commit
that referenced
this pull request
Jul 20, 2026
) Backports the following commits to 8.19: - fix(deps): bump pyasn1 to 0.6.4 for CVE-2026-30922 (#4197) Made with [Cursor](https://cursor.com) Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes https://github.com/elastic/security/issues/12505
Bumps
pyasn1to the latest patch release 0.6.4 to remediate CVE-2026-30922 (High) — a Denial of Service inpyasn1 < 0.6.3: the BER decoder recurses without bound on deeply nested indefinite-lengthSEQUENCE/SETstructures, so a crafted ASN.1 payload can crash the worker viaRecursionError/OOM.pyasn1is a transitive dependency (vialdap3/pyasn1_modules) that we pin directly inapp/connectors_service/pyproject.toml. It was previously capped at<0.6.1by #2817 to avoid apyasn10.6.1 deprecation; this raises that cap straight to the current patch 0.6.4.Why the added
filterwarningspyasn10.6.1+ renamed the BER encoder/decodertagMap/typeMapattributes toTAG_MAP/TYPE_MAP, leaving deprecating aliases.ldap32.9.1 (its last, now unmaintained release) still imports the old names, which emits a benignDeprecationWarning. Our warnings-as-errors test config turned that into a collection error, so two scopedignorefilters were added. The aliases still function at runtime, so there is no behavior change.Scanner A/B (
CVE-2026-30922)Isolated before (
pyasn1==0.6.0) vs after (pyasn1==0.6.4):Checklists
Pre-Review Checklist
config.yml.example)Changes Requiring Extra Attention
Release Note
Bump
pyasn1to 0.6.4 to remediate CVE-2026-30922 (DoS via unbounded recursion in the ASN.1 BER decoder).Made with Cursor