{"id":"CVE-2026-23490","title":"pyasn1 is a generic ASN.1 library for Python","summary":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770"],"vendor":"pyasn1","product":"pyasn1","affected":["pyasn1 < 0.6.2","debian_linux = 11.0"],"patched":["pyasn1 0.6.2"],"published":"2026-01-16","updated":"2026-09-09","sourceUpdated":"2026-09-09T13:18:50.673","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23490","references":[{"url":"https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970","label":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2","label":"security-advisories@github.com"},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq","label":"security-advisories@github.com"},{"url":"https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2026:13508","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13512","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13545","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13553","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:14020","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17446","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17595","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:17611","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1903","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1904","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1905","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1906","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2221","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2299","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2300","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2302","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2303","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2309","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24476","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24483","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2453","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2460","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2483","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2486","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2712","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2758","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28042","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30088","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:3354","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:3359","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:3958","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:3959","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:39894","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4138","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4139","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4140","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4141","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4142","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4143","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4144","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4145","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4146","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4147","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4148","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:4943","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:54757","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:5606","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-23490","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430472","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23490.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23490"},{"url":"https://github.com/pyasn1/pyasn1/commit/be353d755f42ea36539b4f5053c652ddf56979a6"},{"url":"https://github.com/advisories/GHSA-63vm-454h-vhhq"},{"url":"https://github.com/pyasn1/pyasn1"},{"url":"https://github.com/pyasn1/pyasn1/blob/0f07d7242a78ab4d129b26256d7474f7168cf536/pyasn1/codec/ber/decoder.py#L496"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-1810.yaml"},{"url":"https://pypi.org/project/pyasn1"}],"tags":["nvd","cve.org","exploit-available","osv","pip"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-01-16T19:23:28.531270Z"},"epss":0.00771,"epssPercentile":0.54159,"ingestedAt":"2026-06-30T13:26:50.501Z","aliases":["GHSA-63vm-454h-vhhq","PYSEC-2026-1810"],"ecosystem":"pip","slug":"CVE-2026-23490","body":"## Overview\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.\n\n## Affected\n\n- `pyasn1 < 0.6.2`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `pyasn1 0.6.2`\n\n## Package advisory (CVE-2026-23490)\n\nAffected packages:\n\n- `pyasn1 >= 0.6.1, < 0.6.2`\n\nPatched in:\n\n- `pyasn1 0.6.2`\n\nSource: https://osv.dev/vulnerability/GHSA-63vm-454h-vhhq","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":201480,"id":"CVE-2026-23490","ts":1789399491478,"field":"exploit_available","old":"false","new":"true"},{"seq":200214,"id":"CVE-2026-23490","ts":1789397046877,"field":"exploit_available","old":"true","new":"false"},{"seq":198138,"id":"CVE-2026-23490","ts":1789391718756,"field":"exploit_available","old":"false","new":"true"},{"seq":195931,"id":"CVE-2026-23490","ts":1789383378871,"field":"exploit_available","old":"true","new":"false"},{"seq":194860,"id":"CVE-2026-23490","ts":1789380295935,"field":"exploit_available","old":"false","new":"true"},{"seq":193647,"id":"CVE-2026-23490","ts":1789378244352,"field":"exploit_available","old":"true","new":"false"},{"seq":192434,"id":"CVE-2026-23490","ts":1789376216454,"field":"exploit_available","old":"false","new":"true"},{"seq":191221,"id":"CVE-2026-23490","ts":1789373104849,"field":"exploit_available","old":"true","new":"false"},{"seq":190006,"id":"CVE-2026-23490","ts":1789369117012,"field":"exploit_available","old":"false","new":"true"},{"seq":188793,"id":"CVE-2026-23490","ts":1789368031678,"field":"exploit_available","old":"true","new":"false"},{"seq":187576,"id":"CVE-2026-23490","ts":1789364985572,"field":"exploit_available","old":"false","new":"true"},{"seq":186363,"id":"CVE-2026-23490","ts":1789362972332,"field":"exploit_available","old":"true","new":"false"},{"seq":185149,"id":"CVE-2026-23490","ts":1789360956749,"field":"exploit_available","old":"false","new":"true"},{"seq":183936,"id":"CVE-2026-23490","ts":1789357911508,"field":"exploit_available","old":"true","new":"false"},{"seq":182188,"id":"CVE-2026-23490","ts":1789354079853,"field":"exploit_available","old":"false","new":"true"},{"seq":180981,"id":"CVE-2026-23490","ts":1789352930251,"field":"exploit_available","old":"true","new":"false"},{"seq":179774,"id":"CVE-2026-23490","ts":1789349982199,"field":"exploit_available","old":"false","new":"true"},{"seq":178567,"id":"CVE-2026-23490","ts":1789347775655,"field":"exploit_available","old":"true","new":"false"},{"seq":177360,"id":"CVE-2026-23490","ts":1789346167802,"field":"exploit_available","old":"false","new":"true"},{"seq":176153,"id":"CVE-2026-23490","ts":1789342718610,"field":"exploit_available","old":"true","new":"false"},{"seq":175937,"id":"CVE-2026-23490","ts":1789342330580,"field":"exploit_available","old":"false","new":"true"},{"seq":175477,"id":"CVE-2026-23490","ts":1789338371227,"field":"exploit_available","old":"true","new":"false"},{"seq":174272,"id":"CVE-2026-23490","ts":1789334586351,"field":"exploit_available","old":"false","new":"true"},{"seq":173067,"id":"CVE-2026-23490","ts":1789333192834,"field":"exploit_available","old":"true","new":"false"},{"seq":171881,"id":"CVE-2026-23490","ts":1789330873934,"field":"exploit_available","old":"false","new":"true"},{"seq":170695,"id":"CVE-2026-23490","ts":1789328375072,"field":"exploit_available","old":"true","new":"false"},{"seq":169490,"id":"CVE-2026-23490","ts":1789326896529,"field":"exploit_available","old":"false","new":"true"},{"seq":168285,"id":"CVE-2026-23490","ts":1789323413118,"field":"exploit_available","old":"true","new":"false"},{"seq":167080,"id":"CVE-2026-23490","ts":1789319358000,"field":"exploit_available","old":"false","new":"true"},{"seq":165875,"id":"CVE-2026-23490","ts":1789318254469,"field":"exploit_available","old":"true","new":"false"},{"seq":164670,"id":"CVE-2026-23490","ts":1789315527697,"field":"exploit_available","old":"false","new":"true"},{"seq":163465,"id":"CVE-2026-23490","ts":1789313241865,"field":"exploit_available","old":"true","new":"false"},{"seq":162260,"id":"CVE-2026-23490","ts":1789311708017,"field":"exploit_available","old":"false","new":"true"},{"seq":161055,"id":"CVE-2026-23490","ts":1789308246334,"field":"exploit_available","old":"true","new":"false"},{"seq":160560,"id":"CVE-2026-23490","ts":1789304179531,"field":"exploit_available","old":"false","new":"true"},{"seq":158398,"id":"CVE-2026-23490","ts":1789299257799,"field":"exploit_available","old":"true","new":"false"},{"seq":157362,"id":"CVE-2026-23490","ts":1789296454793,"field":"exploit_available","old":"false","new":"true"},{"seq":156157,"id":"CVE-2026-23490","ts":1789294361100,"field":"exploit_available","old":"true","new":"false"},{"seq":154952,"id":"CVE-2026-23490","ts":1789292628572,"field":"exploit_available","old":"false","new":"true"},{"seq":153747,"id":"CVE-2026-23490","ts":1789289333172,"field":"exploit_available","old":"true","new":"false"},{"seq":152959,"id":"CVE-2026-23490","ts":1789285235986,"field":"exploit_available","old":"false","new":"true"},{"seq":152203,"id":"CVE-2026-23490","ts":1789280950650,"field":"exploit_available","old":"true","new":"false"},{"seq":151164,"id":"CVE-2026-23490","ts":1789277446569,"field":"exploit_available","old":"false","new":"true"},{"seq":147893,"id":"CVE-2026-23490","ts":1789270866614,"field":"exploit_available","old":"true","new":"false"},{"seq":145933,"id":"CVE-2026-23490","ts":1789269170623,"field":"exploit_available","old":"false","new":"true"},{"seq":144836,"id":"CVE-2026-23490","ts":1789266101603,"field":"exploit_available","old":"true","new":"false"},{"seq":143740,"id":"CVE-2026-23490","ts":1789262437116,"field":"exploit_available","old":"false","new":"true"},{"seq":142576,"id":"CVE-2026-23490","ts":1789261173392,"field":"exploit_available","old":"true","new":"false"},{"seq":141412,"id":"CVE-2026-23490","ts":1789258607179,"field":"exploit_available","old":"false","new":"true"},{"seq":140214,"id":"CVE-2026-23490","ts":1789256388201,"field":"exploit_available","old":"true","new":"false"}]}