CVE-2026-23490

Aliases:GHSA-63vm-454h-vhhqECHO-8e45-690d-3026PYSEC-2026-1810RHSA-2026:1903RHSA-2026:1904RHSA-2026:1905RHSA-2026:1906RHSA-2026:2221RHSA-2026:2299RHSA-2026:2300RHSA-2026:2302RHSA-2026:2303RHSA-2026:2309RHSA-2026:2453RHSA-2026:2460RHSA-2026:2483RHSA-2026:2486RHSA-2026:2712RHSA-2026:2758RHSA-2026:28042RHSA-2026:3354RHSA-2026:3359RHSA-2026:4138RHSA-2026:4139RHSA-2026:4140RHSA-2026:4141RHSA-2026:4142RHSA-2026:4143RHSA-2026:4144RHSA-2026:4145RHSA-2026:4146RHSA-2026:4147RHSA-2026:4148DEBIAN-CVE-2026-23490CGA-232h-grjw-wqcwCGA-2r55-rjj9-hqmvCGA-3p6x-3w4x-7m2cCGA-59gv-58hj-9x72CGA-5cxm-76h8-3x64CGA-5fqw-3q86-x9hwCGA-5rc2-p6vp-3f48CGA-93g7-h8h6-83p5CGA-93jv-v576-f2vfCGA-9675-379w-gf4mCGA-9jm4-75jh-9285CGA-c64x-wm2r-m87jCGA-fp8g-pq2j-8qghCGA-gjfq-x98h-vh43CGA-gx72-fxf6-558vCGA-hpqm-qcgw-2w5fCGA-mmgp-942r-58pqCGA-p55r-vw66-4fcmCGA-26h8-4h7x-jxh5CGA-29gh-p85m-qg53CGA-2g2r-mf52-jj2jCGA-33wv-xfqg-63jfCGA-3427-4g22-pwhhCGA-3463-3c2x-2q73CGA-367v-vpgh-m6phCGA-37j2-8mh6-83wrCGA-3hrg-r3v7-j85fCGA-44qq-86rp-3q25CGA-54rf-9239-3hwhCGA-56c9-qjqp-h3gcCGA-5fjh-hf2f-55v6CGA-5jq6-vmjf-pr5gCGA-5xjw-3qvm-q66xCGA-635h-2gvm-h2r3CGA-6rg4-cmfw-x88fCGA-6v75-9mvv-5rghCGA-7pfv-r2jg-v94rCGA-7v8c-2qmc-vqgwCGA-89mv-7w4j-5mjvCGA-8q99-5x45-hwc8CGA-9fp6-772v-7x7rCGA-9x78-93qf-3gjhCGA-cjm8-hxw3-vx7fCGA-fq9q-c39h-qfmhCGA-fwpj-wvmg-52hfCGA-gf22-m9p4-xr57CGA-gw99-4fmw-ghx2CGA-jm7x-ww7h-fg7gCGA-mj33-grg2-xqw4CGA-mqr9-jgpc-pfc3CGA-p4rg-6jv7-f9vcCGA-p778-wf74-5gwvCGA-qvp4-3phr-hjw4CGA-r9q9-pmjh-8crxCGA-rgq5-h87m-frpqCGA-rj7p-cm77-pfq2CGA-rjj7-3mr3-74jqCGA-v32w-pr2r-9jfcCGA-v4c7-46rv-2x2fCGA-vf4r-4cvh-6xx9CGA-vf5g-8mv6-v47jCGA-w9hq-xv2x-8jp4CGA-wfw3-ffmp-chq9CGA-wr2m-c6fr-x249CGA-wvh2-f9hj-7vvqCGA-xrvq-65r8-cgcx
Advisory lineage Upstream: 0 Downstream: 52
Modified
Published: 16 Jan 2026, 19:03
Last modified:17 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.77% LOW
1% probability +0.75%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

16 Jan 2026, 19:03
Published
Vulnerability first disclosed
17 Sept 2026, 12:04
Last Modified
Vulnerability information updated

Description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.77%• Percentile: 54%

Techniques & Countermeasures

  • CWE-770•Allocation of Resources Without Limits or Throttling

    The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

  • chainguard•airflow-2

    < 2.11.0-r24

  • chainguard•airflow-3

    < 3.1.6-r2

  • chainguard•ansible-operator

    < 1.42.0-r6

  • chainguard•ansible-operator-fips

    < 1.42.0-r4

  • chainguard•apache-beam-python-3.11-sdk

    < 2.71.0-r0

  • chainguard•authentik

    < 2025.10.3-r5

  • chainguard•authentik-fips

    < 2025.10.3-r2

  • chainguard•barman-cloudnative-pg

    < 3.17.0-r1

  • chainguard•dask-kubernetes

    < 2025.7.0-r6

  • chainguard•dbt-bigquery

    < 1.10.3-r1

  • chainguard•gitlab-toolbox-ce-18.6

    < 18.6.4-r0

  • chainguard•gitlab-toolbox-ce-18.7

    < 18.7.2-r0

  • chainguard•gitlab-toolbox-ce-fips-18.6

    < 18.6.4-r0

  • chainguard•gitlab-toolbox-ce-fips-18.7

    < 18.7.2-r0

  • chainguard•k8s-sidecar

    < 2.4.0-r0

  • chainguard•katib-earlystopping

    < 0.19.0-r4

  • chainguard•kserve-storage-controller

    < 0.16.0-r9

  • chainguard•kubeflow-jupyter-web-app

    < 1.10.0-r10

  • chainguard•kubeflow-pipelines-apiserver

    < 2.15.0-r9

  • chainguard•kubeflow-pipelines-visualization-server

    < 2.15.0-r4

  • chainguard•kubeflow-volumes-web-app

    < 1.10.0-r9

  • chainguard•label-studio

    < 1.22.0-r2

  • chainguard•litellm

    < 1.80.15.0-r1

  • chainguard•localstack

    < 4.12.0-r4

  • chainguard•metaflow-service

    < 2.5.0-r3

  • chainguard•mlflow

    < 3.8.1-r3

  • chainguard•mlflow-iamguarded-compat

    < 3.8.1-r3

  • chainguard•open-webui

    < 0.7.2-r1

  • chainguard•pgadmin4

    < 9.11-r2

  • chainguard•py3-cassandra-medusa

    < 0.27.0-r2

  • chainguard•py3.13-duplicity

    < 3.0.7-r2

  • chainguard•request-1276

    < 0.27.0-r3

  • chainguard•spamcheck

    < 3.5.3-r6

  • chainguard•superset-5.0

    < 5.0.0-r13

  • wolfi•airflow-3

    < 3.1.6-r2

  • wolfi•dask-kubernetes

    < 2025.7.0-r6

  • wolfi•k8s-sidecar

    < 2.4.0-r0

  • wolfi•katib-earlystopping

    < 0.19.0-r4

  • wolfi•kserve-storage-controller

    < 0.16.0-r9

  • wolfi•kubeflow-jupyter-web-app

    < 1.10.0-r10

  • wolfi•kubeflow-pipelines-apiserver

    < 2.15.0-r9

  • wolfi•kubeflow-pipelines-visualization-server

    < 2.15.0-r4

  • wolfi•kubeflow-volumes-web-app

    < 1.10.0-r9

  • wolfi•mlflow

    < 3.8.1-r3

  • wolfi•mlflow-iamguarded-compat

    < 3.8.1-r3

  • wolfi•open-webui

    < 0.7.2-r1

  • wolfi•py3-cassandra-medusa

    < 0.27.0-r2

  • debian•pyasn1

    < 0.4.8-1+deb11u1 | < 0.4.8-3+deb12u1 | < 0.6.1-1+deb13u1 | < 0.6.2-1

  • debian•debian_linux

    11.0

  • pyasn1•pyasn1

    < 0.6.2

Showing first 50 affected entries in server-rendered view.

References (101)