Vulnerability details
CVE-2026-23490
Red Hat Lightspeed CoreRed Hat Migration Toolkit for ContainersRed Hat Migration Toolkit for VirtualizationRed Hat OpenShift LightspeedRed Hat AI Inference ServerRed Hat Ansible Automation Platform 2
pyasn1 has a DoS vulnerability in decoder
CVSS 3.1
7.5High
Official description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Lightspeed Core | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Lightspeed Core | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Migration Toolkit for Containers | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Migration Toolkit for Virtualization | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Migration Toolkit for Virtualization | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Quay 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Satellite 6 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Satellite 6 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Satellite 6 | All | CVEProject cvelistV5 (CNA) |
| pyasn1 | pyasn1 | < 0.6.2 | CVEProject cvelistV5 (CNA) |
References and advisories
60- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq x_refsource_CONFIRM
- https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970 x_refsource_MISC
- https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2 x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2026/02/msg00002.html
- https://access.redhat.com/security/cve/CVE-2026-23490 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2430472 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23490.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:4148 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2758 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3959 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13512 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54757 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28042 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3958 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13508 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17595 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17446 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2309 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4138 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1905 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3354 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1906 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4146 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4145 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2483 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4147 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2486 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4144 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2221 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4139 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2303 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4140 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2300 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4142 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2302 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4143 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2299 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4141 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1903 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3359 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:1904 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2712 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2453 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:2460 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30088 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13553 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13545 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24866 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5606 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17611 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41928 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24977 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19712 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37275 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14020 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:39894 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24476 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24483 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4943 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-01-16
- Last updated
- 2026-09-17
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.76%
Probability of exploitation in 30 days
55.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-770Allocation of Resources Without Limits or Throttling