BER Decoder Mutual Recursion Has No Depth Limit, 250 Nested SEQUENCEs Crash the Process

The decoder in scapy/asn1/ber.py uses mutual recursion: BERcodec_SEQUENCE.do_dec() iterates over the contents of a SEQUENCE and calls BERcodec_Object.dec() for each child element; dec() dispatches to the type-appropriate codec, which for a nested SEQUENCE calls do_dec() again. This creates one Python stack frame per nesting level. The safe=True parameter catches exceptions from malformed encodings but does not bound recursion depth; a structurally valid but deeply nested input bypasses it entirely.

The advisory demonstrates the crash threshold with 250-level nesting. At 250 levels the decoder generates 3,995 stack frames before Python raises RecursionError: maximum recursion depth exceeded. The table below shows nesting depth vs. encoded size and outcome:

The attacker constructs a BER-encoded stream of 250 nested empty SEQUENCE tags. The payload is 833 bytes. No special protocol state or credentials are required; the crash occurs on receipt and decode attempt of the first such packet.

The crash denies service to any Scapy-based process that parses untrusted network traffic. Affected protocol parsers include TLS certificate and handshake parsing, SNMP packet decoding, X.509 certificate parsing, and LDAP packet handling — all of which use the BER decoder. Intrusion detection systems, traffic analyzers, and security appliances built on Scapy are particularly exposed.

The attack is persistent and repeatable: an attacker can resend the 833-byte packet after each process restart to maintain a persistent denial of service. No authentication or prior session state is needed.

Upgrade to scapy ≥ 2.8.0, which introduces a configurable nesting depth limit in the BER decoder. The fix enforces a maximum depth and raises BER_Decoding_Error when exceeded, rather than allowing unbounded recursion.