Every CVESearch/Get API key

CVE-2026-128238

Scapy before 2.8.0 Uncontrolled Recursion DoS via BER SEQUENCE Decoder

6.9 MediumFix available

CVE-2026-128238 is a medium vulnerability (CVSS 6.9) in Secdev Scapy, published November 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in scapy 2.8.0+dfsg-1.

What does this mean?
Severity
6.9 MediumCVSS 4.0, CVE List
Exploit chance
0.47%EPSS, 41st percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.8.0+dfsg-1scapy +9 more

Description

Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.47%Down 0.1 points since Nov 13, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
scapy
Debian:12
All versions, plus listed versions
2.5.0+dfsg-22.5.0+git20240324.2b58b51+dfsg-12.5.0+git20240324.2b58b51+dfsg-22.6.0+dfsg-12.6.0+dfsg-2
Show 6 moreShow less
2.6.1+dfsg-12.6.1+dfsg-22.6.1+dfsg-32.7.0+dfsg-12.7.0+dfsg1-12.8.0+dfsg-1
None known
scapy
Debian:13
All versions, plus listed versions
2.6.1+dfsg-12.6.1+dfsg-22.6.1+dfsg-32.7.0+dfsg-12.7.0+dfsg1-12.8.0+dfsg-1
None known
scapy
Debian:14
before 2.8.0+dfsg-1, plus listed versions
2.6.1+dfsg-12.6.1+dfsg-22.6.1+dfsg-32.7.0+dfsg-12.7.0+dfsg1-1
2.8.0+dfsg-1
scapy
Ubuntu:16.04:LTS
All versions, plus listed versions
2.2.0-1
None known
scapy
Ubuntu:18.04:LTS
All versions, plus listed versions
2.3.3-12.3.3-3
None known
scapy
Ubuntu:20.04:LTS
All versions, plus listed versions
2.4.2-12.4.3-32.4.3-4
None known
scapy
Ubuntu:22.04:LTS
All versions, plus listed versions
2.4.4-4ubuntu1
None known
scapy
Ubuntu:24.04:LTS
All versions, plus listed versions
2.5.0+dfsg-22.5.0+dfsg-2ubuntu1
None known
scapy
Ubuntu:26.10
All versions, plus listed versions
2.7.0+dfsg1-1
None known
scapy
Ubuntu:26.04:LTS
All versions, plus listed versions
2.6.1+dfsg-12.6.1+dfsg-32.7.0+dfsg-12.7.0+dfsg1-1
None known

What each source reports

CVE List Score used6.9

Scapy before 2.8.0 Uncontrolled Recursion DoS via BER SEQUENCE Decoder

Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.

Record
CVE-2026-128238
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-674
Updated
2026-11-13
EUVDEUVD-2026-1250546.9

Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.

Record
EUVD-2026-125054
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-13
GitHub AdvisoriesGHSA-f6c2-ff6x-vmmq6.9

Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in...

Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.

Record
GHSA-f6c2-ff6x-vmmq
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-674
Updated
2026-11-13
NVD6.9

Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.

Record
CVE-2026-128238
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-674
Updated
2026-11-14
OSV6.9

Scapy before 2.8.0 Uncontrolled Recursion DoS via BER SEQUENCE Decoder

Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.

Record
CVE-2026-128238
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-674
Updated
2026-11-14
OSVDEBIAN-CVE-2026-1282386.9

Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.

Record
DEBIAN-CVE-2026-128238
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-14
OSVUBUNTU-CVE-2026-1282386.9

Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQUENCE structures to trigger an unhandled RecursionError, terminating TLS, SNMP, X.509, or LDAP parsers even with safe=True.

Record
UBUNTU-CVE-2026-128238
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-13

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
aliases, referencesNVD, OSV
affected, aliases, published, referencesOSV
publishedEUVD
publishedEUVD
aliases, referencesGitHub Advisories, NVD
aliases, publishedEUVD
first indexedCVE List

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open