CVE-2026-23490

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.
References
Link Resource
https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970 Patch
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2 Product Release Notes
https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq Vendor Advisory
https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13508
https://access.redhat.com/errata/RHSA-2026:13512
https://access.redhat.com/errata/RHSA-2026:13545
https://access.redhat.com/errata/RHSA-2026:13553
https://access.redhat.com/errata/RHSA-2026:14020
https://access.redhat.com/errata/RHSA-2026:17446
https://access.redhat.com/errata/RHSA-2026:17595
https://access.redhat.com/errata/RHSA-2026:17611
https://access.redhat.com/errata/RHSA-2026:1903
https://access.redhat.com/errata/RHSA-2026:1904
https://access.redhat.com/errata/RHSA-2026:1905
https://access.redhat.com/errata/RHSA-2026:1906
https://access.redhat.com/errata/RHSA-2026:19712
https://access.redhat.com/errata/RHSA-2026:2221
https://access.redhat.com/errata/RHSA-2026:2299
https://access.redhat.com/errata/RHSA-2026:2300
https://access.redhat.com/errata/RHSA-2026:2302
https://access.redhat.com/errata/RHSA-2026:2303
https://access.redhat.com/errata/RHSA-2026:2309
https://access.redhat.com/errata/RHSA-2026:24476
https://access.redhat.com/errata/RHSA-2026:24483
https://access.redhat.com/errata/RHSA-2026:2453
https://access.redhat.com/errata/RHSA-2026:2460
https://access.redhat.com/errata/RHSA-2026:2483
https://access.redhat.com/errata/RHSA-2026:2486
https://access.redhat.com/errata/RHSA-2026:24866
https://access.redhat.com/errata/RHSA-2026:24977
https://access.redhat.com/errata/RHSA-2026:2712
https://access.redhat.com/errata/RHSA-2026:2758
https://access.redhat.com/errata/RHSA-2026:28042
https://access.redhat.com/errata/RHSA-2026:30088
https://access.redhat.com/errata/RHSA-2026:3354
https://access.redhat.com/errata/RHSA-2026:3359
https://access.redhat.com/errata/RHSA-2026:37275
https://access.redhat.com/errata/RHSA-2026:3958
https://access.redhat.com/errata/RHSA-2026:3959
https://access.redhat.com/errata/RHSA-2026:39894
https://access.redhat.com/errata/RHSA-2026:4138
https://access.redhat.com/errata/RHSA-2026:4139
https://access.redhat.com/errata/RHSA-2026:4140
https://access.redhat.com/errata/RHSA-2026:4141
https://access.redhat.com/errata/RHSA-2026:4142
https://access.redhat.com/errata/RHSA-2026:4143
https://access.redhat.com/errata/RHSA-2026:4144
https://access.redhat.com/errata/RHSA-2026:4145
https://access.redhat.com/errata/RHSA-2026:4146
https://access.redhat.com/errata/RHSA-2026:4147
https://access.redhat.com/errata/RHSA-2026:4148
https://access.redhat.com/errata/RHSA-2026:41928
https://access.redhat.com/errata/RHSA-2026:42644
https://access.redhat.com/errata/RHSA-2026:4943
https://access.redhat.com/errata/RHSA-2026:5606
https://access.redhat.com/security/cve/CVE-2026-23490
https://bugzilla.redhat.com/show_bug.cgi?id=2430472
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23490.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

History

21 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:41928 -
  • () https://access.redhat.com/errata/RHSA-2026:42644 -

15 Jul 2026, 14:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:39894 -

10 Jul 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:37275 -

30 Jun 2026, 03:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:13508 -
  • () https://access.redhat.com/errata/RHSA-2026:13512 -
  • () https://access.redhat.com/errata/RHSA-2026:13545 -
  • () https://access.redhat.com/errata/RHSA-2026:13553 -
  • () https://access.redhat.com/errata/RHSA-2026:14020 -
  • () https://access.redhat.com/errata/RHSA-2026:17446 -
  • () https://access.redhat.com/errata/RHSA-2026:17595 -
  • () https://access.redhat.com/errata/RHSA-2026:17611 -
  • () https://access.redhat.com/errata/RHSA-2026:1903 -
  • () https://access.redhat.com/errata/RHSA-2026:1904 -
  • () https://access.redhat.com/errata/RHSA-2026:1905 -
  • () https://access.redhat.com/errata/RHSA-2026:1906 -
  • () https://access.redhat.com/errata/RHSA-2026:19712 -
  • () https://access.redhat.com/errata/RHSA-2026:2221 -
  • () https://access.redhat.com/errata/RHSA-2026:2299 -
  • () https://access.redhat.com/errata/RHSA-2026:2300 -
  • () https://access.redhat.com/errata/RHSA-2026:2302 -
  • () https://access.redhat.com/errata/RHSA-2026:2303 -
  • () https://access.redhat.com/errata/RHSA-2026:2309 -
  • () https://access.redhat.com/errata/RHSA-2026:24476 -
  • () https://access.redhat.com/errata/RHSA-2026:24483 -
  • () https://access.redhat.com/errata/RHSA-2026:2453 -
  • () https://access.redhat.com/errata/RHSA-2026:2460 -
  • () https://access.redhat.com/errata/RHSA-2026:2483 -
  • () https://access.redhat.com/errata/RHSA-2026:2486 -
  • () https://access.redhat.com/errata/RHSA-2026:24866 -
  • () https://access.redhat.com/errata/RHSA-2026:24977 -
  • () https://access.redhat.com/errata/RHSA-2026:2712 -
  • () https://access.redhat.com/errata/RHSA-2026:2758 -
  • () https://access.redhat.com/errata/RHSA-2026:28042 -
  • () https://access.redhat.com/errata/RHSA-2026:30088 -
  • () https://access.redhat.com/errata/RHSA-2026:3354 -
  • () https://access.redhat.com/errata/RHSA-2026:3359 -
  • () https://access.redhat.com/errata/RHSA-2026:3958 -
  • () https://access.redhat.com/errata/RHSA-2026:3959 -
  • () https://access.redhat.com/errata/RHSA-2026:4138 -
  • () https://access.redhat.com/errata/RHSA-2026:4139 -
  • () https://access.redhat.com/errata/RHSA-2026:4140 -
  • () https://access.redhat.com/errata/RHSA-2026:4141 -
  • () https://access.redhat.com/errata/RHSA-2026:4142 -
  • () https://access.redhat.com/errata/RHSA-2026:4143 -
  • () https://access.redhat.com/errata/RHSA-2026:4144 -
  • () https://access.redhat.com/errata/RHSA-2026:4145 -
  • () https://access.redhat.com/errata/RHSA-2026:4146 -
  • () https://access.redhat.com/errata/RHSA-2026:4147 -
  • () https://access.redhat.com/errata/RHSA-2026:4148 -
  • () https://access.redhat.com/errata/RHSA-2026:4943 -
  • () https://access.redhat.com/errata/RHSA-2026:5606 -
  • () https://access.redhat.com/security/cve/CVE-2026-23490 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2430472 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23490.json -

17 Jun 2026, 10:21

Type Values Removed Values Added
Summary
  • (es) pyasn1 es una librería ASN.1 genérica para Python. Antes de la versión 0.6.2, se ha encontrado un problema de denegación de servicio que provoca el agotamiento de la memoria debido a un RELATIVE-OID malformado con octetos de continuación excesivos. Esta vulnerabilidad está corregida en la versión 0.6.2.

13 Mar 2026, 14:19

Type Values Removed Values Added
References () https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970 - () https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970 - Patch
References () https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2 - () https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2 - Product, Release Notes
References () https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq - () https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq - Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html - () https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html - Vendor Advisory
First Time Debian
Debian debian Linux
Pyasn1
Pyasn1 pyasn1
CPE cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

01 Feb 2026, 17:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html -

16 Jan 2026, 19:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-01-16 19:16

Updated : 2026-07-21 12:17


NVD link : CVE-2026-23490

Mitre link : CVE-2026-23490

CVE.ORG link : CVE-2026-23490


JSON object : View

Products Affected

debian

  • debian_linux

pyasn1

  • pyasn1
CWE
CWE-770

Allocation of Resources Without Limits or Throttling