PyPI: pyasn1
CVE-2026-23490
Safety vulnerability ID: SFTY-20260116-60729
Safety legacy ID: pyup.io-84605
Affected versions of the pyasn1 package are vulnerable to Denial of Service (DoS) due to unbounded decoding of malformed RELATIVE-OID values with excessive continuation octets. In pyasn1/codec/ber/decoder.py, the BER decoder logic is used by pyasn1.codec.ber.decoder.decode() grows the RELATIVE-OID/OBJECT IDENTIFIER value via the reloid += ((subId << 7) + nextSubId,) accumulation without enforcing a reasonable limit on the number of continuation octets or the resulting object size, which can trigger memory exhaustion during parsing.
Overview
pyasn1 has a DoS vulnerability in decoder
Advisory
Affected versions of the pyasn1 package are vulnerable to Denial of Service (DoS) due to unbounded decoding of malformed RELATIVE-OID values with excessive continuation octets. In pyasn1/codec/ber/decoder.py, the BER decoder logic is used by pyasn1.codec.ber.decoder.decode() grows the RELATIVE-OID/OBJECT IDENTIFIER value via the reloid += ((subId << 7) + nextSubId,) accumulation without enforcing a reasonable limit on the number of continuation octets or the resulting object size, which can trigger memory exhaustion during parsing.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260116-60729/CVE-2026-23490
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23490
- https://github.com/advisories/GHSA-63vm-454h-vhhq
- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq
- https://github.com/pyasn1/pyasn1/commit/be353d755f42ea36539b4f5053c652ddf56979a6
- https://github.com/pyasn1/pyasn1/blob/0f07d7242a78ab4d129b26256d7474f7168cf536/pyasn1/codec/ber/decoder.py#L496
- https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2
- https://nvd.nist.gov/vuln/detail/CVE-2026-23490
- https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970
- https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html
- https://github.com/advisories/GHSA-63vm-454h-vhhq
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more