CVE-2026-23490: pyasn1 Library DoS Vulnerability

CVE-2026-23490 Overview

CVE-2026-23490 is a Denial-of-Service vulnerability affecting pyasn1, a generic ASN.1 library for Python. Prior to version 0.6.2, the library is susceptible to memory exhaustion when processing malformed RELATIVE-OID values containing excessive continuation octets. This vulnerability can be exploited remotely without authentication to cause service disruption through resource exhaustion attacks.

Critical Impact

Remote attackers can trigger memory exhaustion by sending specially crafted ASN.1 data with malformed RELATIVE-OID fields, potentially causing denial of service conditions on systems using the vulnerable pyasn1 library.

Affected Products

• pyasn1 versions prior to 0.6.2
• Python applications utilizing vulnerable pyasn1 versions for ASN.1 parsing
• Services processing untrusted ASN.1 encoded data (certificates, SNMP, LDAP)

Discovery Timeline

• 2026-01-16 - CVE CVE-2026-23490 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-23490

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw exists in how pyasn1 processes RELATIVE-OID encoded values within ASN.1 structures. ASN.1 (Abstract Syntax Notation One) is a standard interface description language used widely in telecommunications, cryptography, and network protocols.

RELATIVE-OID values use a variable-length encoding scheme where continuation octets indicate that more bytes follow. When parsing these values, the vulnerable versions of pyasn1 fail to properly limit memory allocation when encountering malformed data with an excessive number of continuation octets, leading to uncontrolled memory consumption.

Root Cause

The root cause is the absence of proper resource limits during ASN.1 decoding operations. When the decoder encounters RELATIVE-OID data with artificially extended continuation octets, it allocates memory proportionally without imposing reasonable bounds. This allows an attacker to craft input that forces arbitrary amounts of memory to be allocated, eventually exhausting available system memory.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker sends specially crafted ASN.1 encoded data to a target application using pyasn1 for parsing. The malicious payload contains a RELATIVE-OID field with excessive continuation octets, triggering the memory exhaustion condition.

This is particularly dangerous for applications that process untrusted ASN.1 data, including:

• Certificate validation services
• SNMP management systems
• LDAP directory services
• Any application accepting ASN.1 encoded input from untrusted sources

The vulnerability mechanism involves crafting RELATIVE-OID encoded data where continuation bits are set excessively, causing the decoder to allocate memory without proper bounds checking. Detailed technical information is available in the GitHub Security Advisory GHSA-63vm-454h-vhhq.

Detection Methods for CVE-2026-23490

Indicators of Compromise

• Unusual memory consumption spikes in Python processes using pyasn1
• Application crashes or out-of-memory errors during ASN.1 parsing operations
• Abnormally large incoming ASN.1 encoded payloads with extended OID fields
• System slowdown or unresponsiveness in services processing certificate or SNMP data

Detection Strategies

• Monitor Python application memory usage for abnormal growth patterns during ASN.1 parsing
• Implement network traffic analysis to detect oversized or malformed ASN.1 payloads
• Deploy application-level logging to capture ASN.1 parsing failures and memory allocation errors
• Use SentinelOne's behavioral AI to detect anomalous resource consumption patterns indicative of DoS attacks

Monitoring Recommendations

• Configure memory usage alerts for services utilizing pyasn1 to detect early signs of exhaustion
• Implement rate limiting on endpoints that accept ASN.1 encoded data from untrusted sources
• Enable detailed logging for ASN.1 parsing operations to capture malformed input attempts
• Review Python dependency manifests to identify vulnerable pyasn1 versions in production environments

How to Mitigate CVE-2026-23490

Immediate Actions Required

• Upgrade pyasn1 to version 0.6.2 or later immediately across all affected systems
• Audit application dependencies to identify all instances of pyasn1 in your environment
• Implement input validation and size limits on ASN.1 data accepted from untrusted sources
• Consider temporary network-level filtering for oversized ASN.1 payloads if immediate patching is not possible

Patch Information

The vulnerability is fixed in pyasn1 version 0.6.2. The patch implements proper bounds checking during RELATIVE-OID decoding to prevent memory exhaustion. The fix is available through the following resources:

• GitHub Release v0.6.2
• GitHub Commit 3908f144229eed4df24bd569d16e5991ace44970

Workarounds

• Implement application-level memory limits for ASN.1 parsing operations
• Deploy input size restrictions on network endpoints accepting ASN.1 data
• Use containerization with memory limits to contain potential impact of exploitation
• Consider temporarily disabling services that process untrusted ASN.1 data until patching is complete

# Upgrade pyasn1 to patched version
pip install --upgrade pyasn1>=0.6.2

# Verify installed version
pip show pyasn1 | grep Version

# For requirements.txt, ensure minimum version
echo "pyasn1>=0.6.2" >> requirements.txt