pyasn1 <0.6.2: DOS via excessive RELATIVE-OID octets
CVE-2026-23490 Published on January 16, 2026

pyasn1 has a DoS vulnerability in decoder
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

Github Repository NVD

Vulnerability Analysis

CVE-2026-23490 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

NONE

Availability Impact:

HIGH

Weakness Type

Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

Products Associated with CVE-2026-23490

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-23490 are published in these products:

Canonical Ubuntu Linux

Oracle

Red Hat Rhel Els

Red Hat Enterprise Linux (RHEL)

Red Hat Rhel Extras Sap Els

Red Hat Rhel Extras Sap Hana Els

Red Hat Ansible Automation Platform

Red Hat Ansible Automation Platform Developer

Red Hat Ansible Automation Platform Inside

Red Hat Openstack

Red Hat Openshift Ironic

Red Hat Enterprise Linux Eus

Red Hat Rhel Aus

Red Hat Rhel Eus Long Life

Red Hat Rhel E4s

Red Hat Rhel Tus

Red Hat Rhel Eus

Red Hat Ai Inference Server

Red Hat Ceph Storage

Red Hat Enterprise Linux Ai

Red Hat Openshift Ai

Red Hat Stf

Red Hat Trusted Artifact Signer

Red Hat Rhui

Red Hat Lightspeed Core

Red Hat Rhmt

Red Hat Migration Toolkit Virtualization

Red Hat Openshift Lightspeed

Red Hat Openshift

Red Hat Quay

Red Hat Satellite

Red Hat Service Mesh

Affected Versions

pyasn1:

Version < 0.6.2 is affected.

Red Hat Ansible Automation Platform 2.5 for RHEL 8:

Version 0:0.6.3-1.el8ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.5 for RHEL 8:

Version 0:4.6.26-1.el8ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.5 for RHEL 9:

Version 0:0.6.3-1.el9ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.5 for RHEL 9:

Version 0:4.6.26-1.el9ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.6 for RHEL 9:

Version 0:0.6.3-1.el9ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.6 for RHEL 9:

Version 0:4.7.9-1.el9ap and below * is unaffected.

Red Hat Enterprise Linux 10:

Version 0:4.16.0-13.el10_1.2 and below * is unaffected.

Red Hat Enterprise Linux 10:

Version 0:0.6.2-1.el10_1 and below * is unaffected.

Red Hat Enterprise Linux 10.0 Extended Update Support:

Version 0:4.16.0-5.el10_0.8 and below * is unaffected.

Red Hat Enterprise Linux 10.0 Extended Update Support:

Version 0:0.6.2-1.el10_0.1 and below * is unaffected.

Red Hat Enterprise Linux 7 Extended Lifecycle Support:

Version 0:4.1.1-61.el7_9.23 and below * is unaffected.

Red Hat Enterprise Linux 7 Extended Lifecycle Support:

Version 0:0.1.9-7.el7_9.2 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:4.2.1-129.el8_10.21 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:0.3.7-6.el8_10.1 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:4.9.0-54.el8_10.28 and below * is unaffected.

Red Hat Enterprise Linux 8.2 Advanced Update Support:

Version 0:0.3.7-6.el8_2.1 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support:

Version 0:4.2.1-65.el8_4.27 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support:

Version 0:0.3.7-6.el8_4.1 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support:

Version 0:4.1.1-90.el8_4.23 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On:

Version 0:4.2.1-65.el8_4.27 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On:

Version 0:0.3.7-6.el8_4.1 and below * is unaffected.

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On:

Version 0:4.1.1-90.el8_4.23 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support:

Version 0:4.2.1-89.el8_6.21 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support:

Version 0:0.3.7-6.el8_6.1 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Telecommunications Update Service:

Version 0:4.2.1-89.el8_6.21 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Telecommunications Update Service:

Version 0:0.3.7-6.el8_6.1 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Telecommunications Update Service:

Version 0:4.9.0-16.el8_6.20 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions:

Version 0:4.2.1-89.el8_6.21 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions:

Version 0:0.3.7-6.el8_6.1 and below * is unaffected.

Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions:

Version 0:4.9.0-16.el8_6.20 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 0:4.2.1-112.el8_8.16 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 0:0.3.7-6.el8_8.1 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 0:4.9.0-40.el8_8.16 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 0:4.2.1-112.el8_8.16 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 0:0.3.7-6.el8_8.1 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 0:4.9.0-40.el8_8.16 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 0:4.10.0-98.el9_7.5 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 0:0.4.8-7.el9_7 and below * is unaffected.

Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions:

Version 0:4.10.0-20.el9_0.28 and below * is unaffected.

Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions:

Version 0:0.4.8-6.el9_0.1 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions:

Version 0:4.10.0-43.el9_2.19 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions:

Version 0:0.4.8-6.el9_2.1 and below * is unaffected.

Red Hat Enterprise Linux 9.4 Extended Update Support:

Version 0:4.10.0-62.el9_4.22 and below * is unaffected.

Red Hat Enterprise Linux 9.4 Extended Update Support:

Version 0:0.4.8-6.el9_4.1 and below * is unaffected.

Red Hat Enterprise Linux 9.6 Extended Update Support:

Version 0:4.10.0-86.el9_6.15 and below * is unaffected.

Red Hat Enterprise Linux 9.6 Extended Update Support:

Version 0:0.4.8-6.el9_6.1 and below * is unaffected.

Red Hat OpenShift Container Platform 4.17:

Version 0:0.5.1-4.el9 and below * is unaffected.

Red Hat OpenShift Container Platform 4.18:

Version 0:0.5.1-4.el9 and below * is unaffected.

Red Hat OpenStack Platform 17.1 for RHEL 8:

Version 0:0.4.6-5.el8ost and below * is unaffected.

Red Hat AI Inference Server 3.3:

Version 1782353093 and below * is unaffected.

Red Hat Ansible Automation Platform 2.5:

Version 1777398315 and below * is unaffected.

Red Hat Ansible Automation Platform 2.5:

Version 1777402264 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1777296732 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1777391447 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1780102732 and below * is unaffected.

Red Hat Ceph Storage 8:

Version 1774002867 and below * is unaffected.

Red Hat Enterprise Linux AI 3.3:

Version 1778677745 and below * is unaffected.

Red Hat Enterprise Linux AI 3.3:

Version 1778666124 and below * is unaffected.

Red Hat OpenShift AI 2.25:

Version 1780069135 and below * is unaffected.

Red Hat OpenShift AI 2.25:

Version 1780069127 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1778239104 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1778263407 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1778791600 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1779123334 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471587 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471672 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471678 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471731 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471732 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471849 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471734 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471879 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782472374 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471606 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471796 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471661 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471672 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471731 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471929 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471753 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471740 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471834 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471730 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471835 and below * is unaffected.

Red Hat OpenShift AI 3.3:

Version 1782471697 and below * is unaffected.

Red Hat OpenStack Services on OpenShift 18.0:

Version 1782387549 and below * is unaffected.

Red Hat Trusted Artifact Signer 1.3:

Version 1780560117 and below * is unaffected.

Red Hat Trusted Artifact Signer 1.4:

Version 1780914886 and below * is unaffected.

Red Hat Update Infrastructure 5:

Version 1773670137 and below * is unaffected.

Red Hat Service Telemetry Framework 1.5:

Version 1777452540 and below * is unaffected.

Red Hat Service Telemetry Framework 1.5:

Version 1777407251 and below * is unaffected.

Red Hat Service Telemetry Framework 1.5:

Version 1777436150 and below * is unaffected.

Red Hat Lightspeed Core: Red Hat Lightspeed Core: Red Hat Migration Toolkit for Containers: Red Hat Migration Toolkit for Containers: Red Hat Migration Toolkit for Virtualization: Red Hat Migration Toolkit for Virtualization: Red Hat OpenShift Lightspeed: Red Hat OpenShift Lightspeed: Red Hat OpenShift Service Mesh 3: Red Hat AI Inference Server: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Enterprise Linux 6: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenStack Platform 16.2: Red Hat Quay 3: Red Hat Quay 3: Red Hat Satellite 6: Red Hat Satellite 6: Red Hat Satellite 6: Red Hat Satellite 6: Red Hat Satellite 6: Red Hat Satellite 6:

Vulnerable Packages

The following package name and versions may be associated with CVE-2026-23490

Package Manager	Vulnerable Package	Versions	Fixed In
pip	pyasn1	<= 0.6.2	0.6.3

Exploit Probability

EPSS

0.49%

Percentile

38.26%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.

pyasn1 <0.6.2: DOS via excessive RELATIVE-OID octetsCVE-2026-23490 Published on January 16, 2026

Vulnerability Analysis

Weakness Type

Allocation of Resources Without Limits or Throttling

Products Associated with CVE-2026-23490

Affected Versions

Vulnerable Packages

Exploit Probability

pyasn1 <0.6.2: DOS via excessive RELATIVE-OID octets
CVE-2026-23490 Published on January 16, 2026