CVE-2026-23490

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23490.json"
}

References

Affected packages

Git / github.com/pyasn1/pyasn1

Affected ranges

Type

GIT

Repo

https://github.com/pyasn1/pyasn1

Events

Introduced

Fixed

e7356f89cf32c130d65b1a0e903fe7ecce426424

Fixed

3908f144229eed4df24bd569d16e5991ace44970

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.6.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "3908f144229eed4df24bd569d16e5991ace44970"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v0.6.2",
            "range":  [
                {
                    "fixed":  "e7356f89cf32c130d65b1a0e903fe7ecce426424"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.2.3

v0.*

v0.2.1

v0.2.2

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.3.6

v0.3.7

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.5.0

v0.5.1

v0.6.0

v0.6.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23490.json"