Critical Security Update for python3-pyasn1: Denial of Service Vulnerability
Summary
ALSA-2026:3359: Important: python-pyasn1 security update. Affects python3-pyasn1 versions < 0.4.8-7.el9_7. Fixed in 0.4.8-7.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-pyasn1 is a library for encoding and decoding ASN.1 data structures in Python. It is widely used in various applications that require data serialization and communication protocols. The library supports dynamic typing and high-level data types, making it a popular choice among developers. However, it is vulnerable to a Denial of Service (DoS) attack due to memory exhaustion caused by malformed RELATIVE-OID inputs.
Vulnerability Detail
The vulnerability identified as CVE-2026-23490 allows attackers to exploit the pyasn1 library by sending specially crafted RELATIVE-OID data. This malformed input can lead to excessive memory consumption, potentially crashing the application or making it unresponsive. The issue arises from improper handling of the input data, which can be triggered by an attacker without authentication, making it a significant security risk.
How To Fix
Minimum fixed version
0.4.8-7.el9_7
This is the first release that contains the fix.
sudo dnf update python3-pyasn1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to filter out malformed RELATIVE-OID data before it reaches the pyasn1 library. This can help mitigate the risk of memory exhaustion until the package is updated.
Conclusion
The python3-pyasn1 library has a critical vulnerability that can lead to Denial of Service attacks. It is essential to update to the latest patched version to mitigate this risk. Additionally, implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for python3-pyasn1 →
FAQ
CVE-2026-23490 is a security vulnerability in the python3-pyasn1 library that allows for Denial of Service attacks due to memory exhaustion from malformed RELATIVE-OID inputs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to Denial of Service, causing applications to crash or become unresponsive, which can disrupt services and impact users.
Yes, a patch is available. Update to version 0.4.8-7.el9_7 or later for both python3-pyasn1 and python3-pyasn1-modules.
If you cannot update immediately, implement input validation to filter out malformed data as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python3-pyasn1.
