Critical Vulnerability in python3-pyasn1: Denial of Service Risk from Malformed OIDs
Summary
ALSA-2026:4146: Important: python-pyasn1 security update. Affects python3-pyasn1 versions < 0.3.7-6.el8_10.1. Fixed in 0.3.7-6.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-pyasn1 is a library for encoding and decoding ASN.1 data structures in Python. It is widely used in applications that require data serialization and communication protocols. The library provides a high-level interface for working with complex data types, making it essential for developers working with network protocols and data interchange formats. However, a recent vulnerability has been identified that could lead to significant security risks if not addressed promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2026-23490, stems from a Denial of Service (DoS) condition caused by memory exhaustion when processing malformed RELATIVE-OID inputs. Attackers can exploit this vulnerability by sending specially crafted data to applications using python3-pyasn1, potentially leading to service outages and degraded performance. This issue highlights the importance of validating input data and ensuring that libraries handle unexpected formats gracefully.
How To Fix
Minimum fixed version
0.3.7-6.el8_10.1
This is the first release that contains the fix.
sudo dnf update python3-pyasn1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to filter out malformed RELATIVE-OID data before it reaches the python3-pyasn1 library. This can help mitigate the risk of memory exhaustion until the package is updated.
Conclusion
The python3-pyasn1 library has a critical vulnerability that can lead to Denial of Service attacks due to memory exhaustion from malformed inputs. It is crucial to update to the latest patched version to mitigate this risk. Additionally, consider implementing input validation as a temporary measure while preparing for the update.
See every vulnerability recorded for python3-pyasn1 →
FAQ
CVE-2026-23490 is a vulnerability in the python3-pyasn1 library that allows for Denial of Service attacks due to memory exhaustion from malformed RELATIVE-OID inputs.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Failure to address this vulnerability could result in service outages and degraded performance of applications relying on python3-pyasn1, potentially leading to significant operational disruptions.
Yes, Vulert provides a service that monitors and alerts you in real-time for open-source vulnerabilities in your software without requiring code access or installation.
If you cannot update the package right away, implement input validation to filter out malformed data as a temporary workaround until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for python3-pyasn1.
