Critical Denial of Service Vulnerability in python3-pyasn1 and python3-pyasn1-modules
Summary
ALSA-2026:3354: Important: python-pyasn1 security update. Affects python3-pyasn1 versions < 0.6.2-1.el10_1. Fixed in 0.6.2-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted programming language known for its versatility and ease of use. The python3-pyasn1 package provides a pure-Python implementation of ASN.1 (Abstract Syntax Notation One) data structures, while python3-pyasn1-modules offers additional modules for ASN.1 data types. Both packages are essential for applications that require encoding and decoding of ASN.1 data. However, a vulnerability has been identified that could lead to a Denial of Service (DoS) due to memory exhaustion when processing malformed RELATIVE-OID inputs.
Vulnerability Detail
The vulnerability, identified as CVE-2026-23490, stems from the pyasn1 library's inability to handle malformed RELATIVE-OID inputs properly. This oversight can lead to excessive memory consumption, potentially crashing the application or making it unresponsive. Attackers can exploit this vulnerability by sending specially crafted inputs, resulting in a Denial of Service condition. It is crucial for developers and system administrators to address this issue promptly to maintain application stability and security.
How To Fix
Minimum fixed version
0.6.2-1.el10_1
This is the first release that contains the fix.
sudo dnf update python3-pyasn1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to filter out malformed RELATIVE-OID inputs before they reach the pyasn1 processing stage. This can help mitigate the risk of triggering the vulnerability until the packages are updated.
Conclusion
The vulnerability in python3-pyasn1 and python3-pyasn1-modules poses a significant risk due to the potential for Denial of Service attacks. It is essential for users of these packages to update to the latest patched versions and consider implementing input validation as a temporary measure to safeguard their applications.
See every vulnerability recorded for python3-pyasn1 →
FAQ
CVE-2026-23490 is a security vulnerability in the pyasn1 library that allows for Denial of Service due to memory exhaustion from malformed RELATIVE-OID inputs.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to use the Vulert playground without signup.
The primary consequence of this vulnerability is a Denial of Service, where the application may become unresponsive or crash due to excessive memory consumption.
It is recommended to regularly check for updates to your packages and apply security patches as soon as they are available to mitigate vulnerabilities.
Implementing input validation can help prevent malformed inputs from being processed, thus reducing the risk of exploitation until the packages are updated.
Related vulnerabilities
Recent vulnerabilities recorded for python3-pyasn1.
