pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

Project Subscriptions

Vendors Products
Debian Linux Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4463-1 pyasn1 security update
Debian DSA Debian DSA DSA-6114-1 pyasn1 security update
Github GHSA Github GHSA GHSA-63vm-454h-vhhq pyasn1 has a DoS vulnerability in decoder
Ubuntu USN Ubuntu USN USN-7975-1 pyasn1 vulnerability
Ubuntu USN Ubuntu USN USN-8134-1 pyasn1 vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:13508 cve-icon
https://access.redhat.com/errata/RHSA-2026:13512 cve-icon
https://access.redhat.com/errata/RHSA-2026:13545 cve-icon
https://access.redhat.com/errata/RHSA-2026:13553 cve-icon
https://access.redhat.com/errata/RHSA-2026:14020 cve-icon
https://access.redhat.com/errata/RHSA-2026:17446 cve-icon
https://access.redhat.com/errata/RHSA-2026:17595 cve-icon
https://access.redhat.com/errata/RHSA-2026:17611 cve-icon
https://access.redhat.com/errata/RHSA-2026:1903 cve-icon
https://access.redhat.com/errata/RHSA-2026:1904 cve-icon
https://access.redhat.com/errata/RHSA-2026:1905 cve-icon
https://access.redhat.com/errata/RHSA-2026:1906 cve-icon
https://access.redhat.com/errata/RHSA-2026:19712 cve-icon
https://access.redhat.com/errata/RHSA-2026:2221 cve-icon
https://access.redhat.com/errata/RHSA-2026:2299 cve-icon
https://access.redhat.com/errata/RHSA-2026:2300 cve-icon
https://access.redhat.com/errata/RHSA-2026:2302 cve-icon
https://access.redhat.com/errata/RHSA-2026:2303 cve-icon
https://access.redhat.com/errata/RHSA-2026:2309 cve-icon
https://access.redhat.com/errata/RHSA-2026:24476 cve-icon
https://access.redhat.com/errata/RHSA-2026:24483 cve-icon
https://access.redhat.com/errata/RHSA-2026:2453 cve-icon
https://access.redhat.com/errata/RHSA-2026:2460 cve-icon
https://access.redhat.com/errata/RHSA-2026:2483 cve-icon
https://access.redhat.com/errata/RHSA-2026:2486 cve-icon
https://access.redhat.com/errata/RHSA-2026:24866 cve-icon
https://access.redhat.com/errata/RHSA-2026:24977 cve-icon
https://access.redhat.com/errata/RHSA-2026:2712 cve-icon
https://access.redhat.com/errata/RHSA-2026:2758 cve-icon
https://access.redhat.com/errata/RHSA-2026:28042 cve-icon
https://access.redhat.com/errata/RHSA-2026:30088 cve-icon
https://access.redhat.com/errata/RHSA-2026:3354 cve-icon
https://access.redhat.com/errata/RHSA-2026:3359 cve-icon
https://access.redhat.com/errata/RHSA-2026:37275 cve-icon
https://access.redhat.com/errata/RHSA-2026:3958 cve-icon
https://access.redhat.com/errata/RHSA-2026:3959 cve-icon
https://access.redhat.com/errata/RHSA-2026:39894 cve-icon
https://access.redhat.com/errata/RHSA-2026:4138 cve-icon
https://access.redhat.com/errata/RHSA-2026:4139 cve-icon
https://access.redhat.com/errata/RHSA-2026:4140 cve-icon
https://access.redhat.com/errata/RHSA-2026:4141 cve-icon
https://access.redhat.com/errata/RHSA-2026:4142 cve-icon
https://access.redhat.com/errata/RHSA-2026:4143 cve-icon
https://access.redhat.com/errata/RHSA-2026:4144 cve-icon
https://access.redhat.com/errata/RHSA-2026:4145 cve-icon
https://access.redhat.com/errata/RHSA-2026:4146 cve-icon
https://access.redhat.com/errata/RHSA-2026:4147 cve-icon
https://access.redhat.com/errata/RHSA-2026:4148 cve-icon
https://access.redhat.com/errata/RHSA-2026:41928 cve-icon
https://access.redhat.com/errata/RHSA-2026:42644 cve-icon
https://access.redhat.com/errata/RHSA-2026:4943 cve-icon
https://access.redhat.com/errata/RHSA-2026:5606 cve-icon
https://access.redhat.com/security/cve/CVE-2026-23490 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2430472 cve-icon
https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970 cve-icon cve-icon cve-icon
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2 cve-icon cve-icon cve-icon
https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq cve-icon cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-23490 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23490.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-23490 cve-icon
History

Fri, 13 Mar 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Debian
Debian debian Linux
CPEs cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Vendors & Products Debian
Debian debian Linux

Sun, 01 Feb 2026 17:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Important


Mon, 19 Jan 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Pyasn1
Pyasn1 pyasn1
Vendors & Products Pyasn1
Pyasn1 pyasn1

Fri, 16 Jan 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 16 Jan 2026 19:15:00 +0000

Type Values Removed Values Added
Description pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.
Title pyasn1 has a DoS vulnerability in decoder
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-10T12:05:41.593Z

Reserved: 2026-01-13T15:47:41.628Z

Link: CVE-2026-23490

cve-icon Vulnrichment

Updated: 2026-02-01T17:06:14.113Z

cve-icon NVD

Status : Modified

Published: 2026-01-16T19:16:19.117

Modified: 2026-08-05T13:21:02.117

Link: CVE-2026-23490

cve-icon Redhat

Severity : Important

Publid Date: 2026-01-16T19:03:36Z

Links: CVE-2026-23490 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T19:15:10Z

Weaknesses