high
7.5
CVE-2026-23490 json
pyasn1 has a DoS vulnerability in decoder
published 2026-01-16 9 mo ago modified 2026-09-17 52 d ago also GHSA-63vm-454h-vhhq , PYSEC-2026-1810 , EUVD-2026-2865
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.
Patch / fix
- pypi pyasn1 0.6.2
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:0.6.3-1.el8ap, 0:4.6.26-1.el8ap
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:0.6.3-1.el9ap, 0:4.6.26-1.el9ap
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:0.6.3-1.el9ap, 0:4.7.9-1.el9ap
- Red Hat Red Hat Enterprise Linux 10 0:0.6.2-1.el10_1, 0:4.16.0-13.el10_1.2
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:0.6.2-1.el10_0.1, 0:4.16.0-5.el10_0.8
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:0.1.9-7.el7_9.2, 0:4.1.1-61.el7_9.23
- Red Hat Red Hat Enterprise Linux 8 0:0.3.7-6.el8_10.1, 0:4.2.1-129.el8_10.21, 0:4.9.0-54.el8_10.28
- Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 0:0.3.7-6.el8_2.1
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:0.3.7-6.el8_4.1, 0:4.1.1-90.el8_4.23, 0:4.2.1-65.el8_4.27
- Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:0.3.7-6.el8_4.1, 0:4.1.1-90.el8_4.23, 0:4.2.1-65.el8_4.27
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:0.3.7-6.el8_6.1, 0:4.2.1-89.el8_6.21
- Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:0.3.7-6.el8_6.1, 0:4.2.1-89.el8_6.21, 0:4.9.0-16.el8_6.20
- Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:0.3.7-6.el8_6.1, 0:4.2.1-89.el8_6.21, 0:4.9.0-16.el8_6.20
- Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:0.3.7-6.el8_8.1, 0:4.2.1-112.el8_8.16, 0:4.9.0-40.el8_8.16
- Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:0.3.7-6.el8_8.1, 0:4.2.1-112.el8_8.16, 0:4.9.0-40.el8_8.16
- Red Hat Red Hat Enterprise Linux 9 0:0.4.8-7.el9_7, 0:4.10.0-98.el9_7.5
- Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:0.4.8-6.el9_0.1, 0:4.10.0-20.el9_0.28
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:0.4.8-6.el9_2.1, 0:4.10.0-43.el9_2.19
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:0.4.8-6.el9_4.1, 0:4.10.0-62.el9_4.22
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:0.4.8-6.el9_6.1, 0:4.10.0-86.el9_6.15
- Red Hat Red Hat OpenShift Container Platform 4.17 0:0.5.1-4.el9
- Red Hat Red Hat OpenShift Container Platform 4.18 0:0.5.1-4.el9
- Red Hat Red Hat OpenStack Platform 16.2 0:0.4.6-4.el8ost
- Red Hat Red Hat OpenStack Platform 17.1 for RHEL 8 0:0.4.6-5.el8ost
- Red Hat Red Hat AI Inference Server 3.3 1782353093
- Red Hat Red Hat Ansible Automation Platform 2.5 1777398315, 1777402264
- Red Hat Red Hat Ansible Automation Platform 2.6 1777296732, 1777391447, 1780102732
- Red Hat Red Hat Ceph Storage 8 1774002867
- Red Hat Red Hat Enterprise Linux AI 3.3 1778666124, 1778677745
- pyasn1 Debian 12 0.4.8-3+deb12u1
- pyasn1 Debian 13 0.6.1-1+deb13u1
- pyasn1 Debian 14 0.6.2-1
debian advisories DEBIAN-CVE-2026-23490
- pyasn1 Ubuntu 22.04 LTS 0.4.8-1ubuntu0.1
- pyasn1 Ubuntu 24.04 LTS 0.4.8-4ubuntu0.1
- pyasn1 Ubuntu 25.10 0.6.1-1ubuntu0.1
- pyasn1 Ubuntu Pro 14.04 LTS 0.1.7-1ubuntu2.1+esm1
- pyasn1 Ubuntu Pro 16.04 LTS 0.1.9-1ubuntu0.1~esm1
- pyasn1 Ubuntu Pro 18.04 LTS 0.4.2-3ubuntu0.18.04.1~esm1
- pyasn1 Ubuntu Pro 20.04 LTS 0.4.2-3ubuntu0.20.04.1~esm1
ubuntu advisories UBUNTU-CVE-2026-23490
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- etcd openstack 16.2 3.3.23-22.el8ost
- erlang openstack 16.2 23.3.4.18-2.el8ost
- erlang-ssl openstack 16.2 23.3.4.18-2.el8ost
- erlang-asn1 openstack 16.2 23.3.4.18-2.el8ost
- erlang-erts openstack 16.2 23.3.4.18-2.el8ost
- erlang-hipe openstack 16.2 23.3.4.18-2.el8ost
- erlang-sasl openstack 16.2 23.3.4.18-2.el8ost
- erlang-snmp openstack 16.2 23.3.4.18-2.el8ost
red hat advisories RHSA-2026:54757RHSA-2026:28042RHSA-2026:17595RHSA-2026:17446RHSA-2026:13508RHSA-2026:13512
- python-pyasn1 Linux Micro 6.1 0.5.0-slfo.1.1_2.1
- python-pyasn1 Linux Micro 6.0 0.5.0-3.1
- python-pyasn1 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +12 more 0.4.2-150000.3.13.1
- python-pyasn1 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 0.6.1-160000.3.1
- python-pyasn1 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +10 more 0.5.0-150400.12.10.1
- python-pyasn1 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 0.1.9-4.11.1
suse advisories SUSE-SU-2026:20482-1SUSE-SU-2026:20447-1SUSE-SU-2026:0430-1SUSE-SU-2026:0300-1SUSE-SU-2026:20133-1SUSE-SU-2026:20158-1
- python-pyasn1 openSUSE Leap 16.0 0.6.1-160000.3.1
- python-pyasn1 openSUSE Tumbleweed 0.6.2-1.1
opensuse advisories openSUSE-SU-2026:20089-1openSUSE-SU-2026:10078-1
- python3-pyasn1 AlmaLinux 8 0.3.7-6.el8_10.1
- python3-pyasn1-modules AlmaLinux 8 0.3.7-6.el8_10.1
- python3-pyasn1 AlmaLinux 10 0.6.2-1.el10_1
- python3-pyasn1-modules AlmaLinux 10 0.6.2-1.el10_1
- python3-pyasn1 AlmaLinux 9 0.4.8-7.el9_7
- python3-pyasn1-modules AlmaLinux 9 0.4.8-7.el9_7
- fence-virt AlmaLinux 9 4.10.0-98.el9_7.5
- fence-virtd AlmaLinux 9 4.10.0-98.el9_7.5
almalinux advisories ALSA-2026:4146ALSA-2026:3354ALSA-2026:3359ALSA-2026:1903ALSA-2026:1904ALSA-2026:1905
- python-pyasn1 Rocky Linux 8 0.3.7-6.el8_10.1
- python-pyasn1 Rocky Linux 9 0.4.8-7.el9_7
- python-pyasn1 Rocky Linux 10 0.6.2-1.el10_1
- fence-agents Rocky Linux 10 4.16.0-13.el10_1.2
- resource-agents Rocky Linux 8 4.9.0-54.el8_10.28
- fence-agents Rocky Linux 8 4.2.1-129.el8_10.21
- fence-agents Rocky Linux 9 4.10.0-98.el9_7.5
rocky linux advisories RLSA-2026:4146RLSA-2026:3359RLSA-2026:3354RLSA-2026:1905RLSA-2026:1904RLSA-2026:1906
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-23490 updated cvss 7.5
pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID
-
Red Hat Lightspeed Core lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/dataverse-exporter-rhel9affected: no fix available
-
Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-rhel8-operatoraffected: no fix planned “Will not fix”
-
Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-rhel9-operator, migration-toolkit-virtualization/mtv-rhel9-operatoraffected: no fix available, no fix planned “Will not fix”
-
Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9affected: no fix available
-
Red Hat AI Inference Server rhaiis/vllm-tpu-rhel9affected: no fix planned “Will not fix”
-
Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/ee-minimal-rhel8, ansible-automation-platform-24/ee-minimal-rhel9, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/ee-minimal-rhel8, ansible-automation-platform-25/ee-minimal-rhel9, ansible-automation-platform-25/lightspeed-rhel8, +5 moreaffected: no fix available, no fix planned “Will not fix”
-
Red Hat OpenShift AI (RHOAI) rhoai/odh-ml-pipelines-runtime-generic-rhel9affected: no fix available
-
Red Hat OpenShift Container Platform 4 openshift4/ztp-site-generate-rhel8, openshift4/ose-ansible-rhel9-operatoraffected: no fix available, no fix planned “Will not fix”
show 30 moreshow fewer
-
Red Hat Quay 3 quay/quay-rhel8affected: no fix planned “Will not fix”
-
Red Hat Satellite 6 python3.12-pyasn1-modules, satellite/iop-advisor-engine-rhel9, satellite/iop-insights-engine-rhel9affected: no fix available, no fix planned “Will not fix”
-
Red Hat Ironic content for Red Hat OpenShift Container Platform 4.17 python-pyasn1 0.5.1-4.el9, python3-pyasn1 0.5.1-4.el9, python3-pyasn1-modules 0.5.1-4.el9fixed: vendor fix RHSA-2026:17595
-
Red Hat Ironic content for Red Hat OpenShift Container Platform 4.18 python-pyasn1 0.5.1-4.el9, python3-pyasn1 0.5.1-4.el9, python3-pyasn1-modules 0.5.1-4.el9fixed: vendor fix RHSA-2026:17446
-
Red Hat AI Inference Server 3.3 rhaiis/vllm-rocm-rhel9 1782353093fixed: vendor fix RHSA-2026:30088
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25 1777398315, ansible-automation-platform-25 1777402264fixed: vendor fix RHSA-2026:13553
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-pyasn1 0.6.3-1.el8ap, automation-controller 4.6.26-1.el8ap, automation-controller-ui 4.6.26-1.el8ap, automation-controller-cli 4.6.26-1.el8ap, automation-controller-server 4.6.26-1.el8ap, automation-controller-venv-tower 4.6.26-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-pyasn1 0.6.3-1.el9ap, automation-controller 4.6.26-1.el9ap, automation-controller-ui 4.6.26-1.el9ap, automation-controller-cli 4.6.26-1.el9ap, automation-controller-server 4.6.26-1.el9ap, automation-controller-venv-tower 4.6.26-1.el9apfixed: vendor fix RHSA-2026:3959
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1777296732, ansible-automation-platform-26 1777391447, ansible-automation-platform-26/lightspeed-chatbot-rhel9 1780102732fixed: vendor fix RHSA-2026:13545
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-pyasn1 0.6.3-1.el9ap, automation-controller 4.7.9-1.el9ap, automation-controller-ui 4.7.9-1.el9ap, automation-controller-cli 4.7.9-1.el9ap, automation-controller-server 4.7.9-1.el9ap, automation-controller-venv-tower 4.7.9-1.el9apfixed: vendor fix RHSA-2026:3958
-
Red Hat Ceph Storage 8 rhceph 1774002867fixed: vendor fix RHSA-2026:5606
-
Red Hat Enterprise Linux AI 3.3 rhelai3 1778666124, rhelai3 1778677745fixed: vendor fix RHSA-2026:17611
-
Red Hat Enterprise Linux AppStream (v. 8) python-pyasn1 0.3.7-6.el8_10.1, python3-pyasn1 0.3.7-6.el8_10.1, fence-agents 4.2.1-129.el8_10.21, fence-agents-all 4.2.1-129.el8_10.21, fence-agents-apc 4.2.1-129.el8_10.21, fence-agents-eps 4.2.1-129.el8_10.21, +41 morefixed: vendor fix RHSA-2026:1906
-
Red Hat Enterprise Linux AppStream (v. 9) python-pyasn1 0.4.8-7.el9_7, fence-virt 4.10.0-98.el9_7.5, python3-pyasn1 0.4.8-7.el9_7, fence-virtd 4.10.0-98.el9_7.5, fence-agents 4.10.0-98.el9_7.5, fence-virtd-cpg 4.10.0-98.el9_7.5, +54 morefixed: vendor fix RHSA-2026:1903
-
Red Hat Enterprise Linux AppStream (v. 10) python-pyasn1 0.6.2-1.el10_1, fence-virt 4.16.0-13.el10_1.2, python3-pyasn1 0.6.2-1.el10_1, fence-virtd 4.16.0-13.el10_1.2, fence-agents 4.16.0-13.el10_1.2, fence-virtd-cpg 4.16.0-13.el10_1.2, +53 morefixed: vendor fix RHSA-2026:1905
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) python-pyasn1 0.3.7-6.el8_2.1, python3-pyasn1 0.3.7-6.el8_2.1, python3-pyasn1-modules 0.3.7-6.el8_2.1fixed: vendor fix RHSA-2026:4145
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) python-pyasn1 0.3.7-6.el8_4.1, fence-agents 4.2.1-65.el8_4.27, python3-pyasn1 0.3.7-6.el8_4.1, fence-agents-all 4.2.1-65.el8_4.27, fence-agents-apc 4.2.1-65.el8_4.27, fence-agents-eps 4.2.1-65.el8_4.27, +39 morefixed: vendor fix RHSA-2026:2483
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) python-pyasn1 0.3.7-6.el8_6.1, fence-agents 4.2.1-89.el8_6.21, python3-pyasn1 0.3.7-6.el8_6.1, fence-agents-all 4.2.1-89.el8_6.21, fence-agents-apc 4.2.1-89.el8_6.21, fence-agents-eps 4.2.1-89.el8_6.21, +40 more Red Hat Enterprise Linux AppStream E4S (v.8.6) python-pyasn1 0.3.7-6.el8_6.1, fence-agents 4.2.1-89.el8_6.21, python3-pyasn1 0.3.7-6.el8_6.1, fence-agents-all 4.2.1-89.el8_6.21, fence-agents-apc 4.2.1-89.el8_6.21, fence-agents-eps 4.2.1-89.el8_6.21, +41 morefixed: vendor fix RHSA-2026:2486
-
Red Hat Enterprise Linux AppStream E4S (v.8.8) python-pyasn1 0.3.7-6.el8_8.1, python3-pyasn1 0.3.7-6.el8_8.1, fence-agents 4.2.1-112.el8_8.16, fence-agents-all 4.2.1-112.el8_8.16, fence-agents-apc 4.2.1-112.el8_8.16, fence-agents-eps 4.2.1-112.el8_8.16, +40 morefixed: vendor fix RHSA-2026:2221
-
Red Hat Enterprise Linux AppStream E4S (v.9.0) fence-virt 4.10.0-20.el9_0.28, python-pyasn1 0.4.8-6.el9_0.1, fence-virtd 4.10.0-20.el9_0.28, python3-pyasn1 0.4.8-6.el9_0.1, fence-agents 4.10.0-20.el9_0.28, fence-virtd-cpg 4.10.0-20.el9_0.28, +12 morefixed: vendor fix RHSA-2026:2303
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-virt 4.10.0-43.el9_2.19, python-pyasn1 0.4.8-6.el9_2.1, fence-virtd 4.10.0-43.el9_2.19, python3-pyasn1 0.4.8-6.el9_2.1, fence-agents 4.10.0-43.el9_2.19, fence-virtd-cpg 4.10.0-43.el9_2.19, +11 morefixed: vendor fix RHSA-2026:2300
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) fence-virt 4.16.0-5.el10_0.8, fence-virtd 4.16.0-5.el10_0.8, fence-agents 4.16.0-5.el10_0.8, python-pyasn1 0.6.2-1.el10_0.1, python3-pyasn1 0.6.2-1.el10_0.1, fence-virtd-cpg 4.16.0-5.el10_0.8, +53 morefixed: vendor fix RHSA-2026:2309
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) fence-virt 4.10.0-62.el9_4.22, python-pyasn1 0.4.8-6.el9_4.1, fence-virtd 4.10.0-62.el9_4.22, python3-pyasn1 0.4.8-6.el9_4.1, fence-agents 4.10.0-62.el9_4.22, fence-virtd-cpg 4.10.0-62.el9_4.22, +11 morefixed: vendor fix RHSA-2026:2302
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-virt 4.10.0-86.el9_6.15, python-pyasn1 0.4.8-6.el9_6.1, fence-virtd 4.10.0-86.el9_6.15, python3-pyasn1 0.4.8-6.el9_6.1, fence-agents 4.10.0-86.el9_6.15, fence-virtd-cpg 4.10.0-86.el9_6.15, +54 morefixed: vendor fix RHSA-2026:2299
-
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) python-pyasn1 0.3.7-6.el8_4.1, fence-agents 4.2.1-65.el8_4.27, python3-pyasn1 0.3.7-6.el8_4.1, fence-agents-all 4.2.1-65.el8_4.27, fence-agents-apc 4.2.1-65.el8_4.27, fence-agents-eps 4.2.1-65.el8_4.27, +36 morefixed: vendor fix RHSA-2026:2483
-
Red Hat Enterprise Linux AppStream TUS (v.8.6) python-pyasn1 0.3.7-6.el8_6.1, fence-agents 4.2.1-89.el8_6.21, python3-pyasn1 0.3.7-6.el8_6.1, fence-agents-all 4.2.1-89.el8_6.21, fence-agents-apc 4.2.1-89.el8_6.21, fence-agents-eps 4.2.1-89.el8_6.21, +40 morefixed: vendor fix RHSA-2026:2486
-
Red Hat Enterprise Linux AppStream TUS (v.8.8) python-pyasn1 0.3.7-6.el8_8.1, python3-pyasn1 0.3.7-6.el8_8.1, fence-agents 4.2.1-112.el8_8.16, fence-agents-all 4.2.1-112.el8_8.16, fence-agents-apc 4.2.1-112.el8_8.16, fence-agents-eps 4.2.1-112.el8_8.16, +39 morefixed: vendor fix RHSA-2026:2221
-
Red Hat Enterprise Linux High Availability AUS (v.8.4) resource-agents 4.1.1-90.el8_4.23, fence-agents-aws 4.2.1-65.el8_4.27, fence-agents-gce 4.2.1-65.el8_4.27, fence-agents-aliyun 4.2.1-65.el8_4.27, resource-agents-gcp 4.1.1-90.el8_4.23, fence-agents-azure-arm 4.2.1-65.el8_4.27, +1 morefixed: vendor fix RHSA-2026:2483
-
Red Hat Enterprise Linux High Availability E4S (v.8.6) resource-agents 4.9.0-16.el8_6.20, fence-agents-aws 4.2.1-89.el8_6.21, fence-agents-gce 4.2.1-89.el8_6.21, fence-agents-aliyun 4.2.1-89.el8_6.21, resource-agents-gcp 4.9.0-16.el8_6.20, resource-agents-paf 4.9.0-16.el8_6.20, +2 morefixed: vendor fix RHSA-2026:2486
-
Red Hat Enterprise Linux High Availability E4S (v.8.8) resource-agents 4.9.0-40.el8_8.16, fence-agents-aws 4.2.1-112.el8_8.16, fence-agents-gce 4.2.1-112.el8_8.16, resource-agents-gcp 4.9.0-40.el8_8.16, resource-agents-paf 4.9.0-40.el8_8.16, fence-agents-aliyun 4.2.1-112.el8_8.16, +3 morefixed: vendor fix RHSA-2026:2221
-
Red Hat Enterprise Linux High Availability E4S (v.9.0) fence-agents-all 4.10.0-20.el9_0.28, fence-agents-apc 4.10.0-20.el9_0.28, fence-agents-aws 4.10.0-20.el9_0.28, fence-agents-eps 4.10.0-20.el9_0.28, fence-agents-gce 4.10.0-20.el9_0.28, fence-agents-rsa 4.10.0-20.el9_0.28, +37 morefixed: vendor fix RHSA-2026:2303
25 more fixed, 22 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.76% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pyasn1 | >=0.6.1, <0.6.2 |
0.6.2 |
Affected products
- pyasn1 pyasn1
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
- Red Hat Red Hat OpenShift Container Platform 4.17
- Red Hat Red Hat OpenShift Container Platform 4.18
- Red Hat Red Hat OpenStack Platform 16.2
- Red Hat Red Hat OpenStack Platform 17.1 for RHEL 8
- Red Hat Red Hat AI Inference Server 3.3
- Red Hat Red Hat Ansible Automation Platform 2.5
- Red Hat Red Hat Ansible Automation Platform 2.6
- Red Hat Red Hat Ceph Storage 8
- Red Hat Red Hat Enterprise Linux AI 3.3
- Red Hat Red Hat Migration Toolkit 1.8
- Red Hat Red Hat OpenShift AI 2.25
- Red Hat Red Hat OpenShift AI 3.3
- Red Hat Red Hat OpenStack 1.5
- Red Hat Red Hat OpenStack Services on OpenShift 18.0
- Red Hat Red Hat Trusted Artifact Signer 1.3
- Red Hat Red Hat Trusted Artifact Signer 1.4
- Red Hat Red Hat Update Infrastructure 5
- Red Hat Lightspeed Core
- Red Hat Migration Toolkit for Containers
- Red Hat Migration Toolkit for Virtualization
- Red Hat OpenShift Lightspeed
- Red Hat OpenShift Service Mesh 3
- Red Hat Red Hat AI Inference Server
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat OpenShift AI (RHOAI)
- Red Hat Red Hat OpenShift Container Platform 4
- Red Hat Red Hat Quay 3
- Red Hat Red Hat Satellite 6
Classification
References
-
github.com
/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970
web, patch
-
github.com
/pyasn1/pyasn1/commit/be353d755f42ea36539b4f5053c652ddf56979a6
web
-
access.redhat.com
/errata/RHSA-2026:4148
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:2758
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:3959
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:13512
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:54757
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:28042
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:3958
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:13508
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:17595
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:17446
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:2309
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:4138
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:1905
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:3354
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:1906
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:4146
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:4145
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:2483
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:4147
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:2486
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:4144
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:2221
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:4139
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:2303
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:4140
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:2300
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:4142
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:2302
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:4143
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:2299
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:4141
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:1903
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:3359
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:1904
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:2712
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:2453
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:2460
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:30088
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:13553
vendor-advisory
-
github.com
/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq
web, vendor-advisory
-
lists.debian.org
/debian-lts-announce/2026/02/msg00002.html
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-23490
advisory
-
access.redhat.com
/errata/RHSA-2026:39894
web
-
access.redhat.com
/errata/RHSA-2026:41928
web
-
access.redhat.com
/errata/RHSA-2026:42644
web
-
access.redhat.com
/errata/RHSA-2026:4943
web
-
access.redhat.com
/errata/RHSA-2026:5606
web
-
access.redhat.com
/security/cve/CVE-2026-23490
web
-
bugzilla.redhat.com
/show_bug.cgi?id=2430472
web
-
github.com
/advisories/GHSA-63vm-454h-vhhq
advisory
-
github.com
/pyasn1/pyasn1
package
-
github.com
/pyasn1/pyasn1/blob/0f07d7242a78ab4d129b26256d7474f7168cf536/pyasn1/codec/ber/decoder.py#L496
web
-
github.com
/pyasn1/pyasn1/releases/tag/v0.6.2
web, product, release-notes
-
github.com
/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-1810.yaml
web
-
pypi.org
/project/pyasn1
web, package
-
security.access.redhat.com
/data/csaf/v2/vex/2026/cve-2026-23490.json
web
-
access.redhat.com
/errata/RHSA-2026:19712
web
- access.redhat.com /errata/RHSA-2026:13545
Sources
- CVE List CVE-2026-23490
- GitHub Advisory GHSA-63vm-454h-vhhq
- NVD CVE-2026-23490
- OSV PYSEC-2026-1810
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.