CVE-2026-23490: 
Python vulnerability analysis and mitigation

CVE-2026-23490 is a Denial-of-Service vulnerability in pyasn1, a generic ASN.1 library for Python, caused by memory exhaustion when parsing malformed RELATIVE-OID structures with excessive continuation octets. It affects all pyasn1 versions prior to 0.6.2 and was disclosed on January 16, 2026, via a GitHub Security Advisory. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, NVD). Downstream products from IBM, Oracle, Red Hat, Debian, SUSE, Ubuntu, and Splunk have also been identified as affected due to their dependency on pyasn1 (Feedly).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In the BER decoder (pyasn1/codec/ber/decoder.py), the OID and RELATIVE-OID arc parsing loop accumulates sub-identifier values via bit-shifting (subId = (subId << 7) + (nextSubId & 0x7F)) without any limit on the number of continuation octets (bytes with the high bit set). An attacker can craft a malformed ASN.1 payload consisting of a large sequence of 0x81 or 0xFF continuation bytes, causing the decoder to allocate an arbitrarily large integer in memory, exhausting available RAM. The fix in version 0.6.2 introduces a hard limit of 20 continuation octets per OID arc (MAX_OID_ARC_CONTINUATION_OCTETS = 20), raising a PyAsn1Error if exceeded (GitHub Advisory, Patch Commit). A public proof-of-concept script was included in the original advisory, demonstrating the attack using crafted DER-encoded packets (GitHub Advisory).

Successful exploitation causes the affected application to exhaust system memory, resulting in a crash or service outage (high availability impact). There is no confidentiality or integrity impact. Services that parse untrusted ASN.1 data — such as LDAP servers, TLS/SSL endpoints, OCSP responders, and applications validating X.509 certificates — are particularly at risk, as an unauthenticated remote attacker can trigger the condition by submitting a malicious certificate or ASN.1 structure (GitHub Advisory). The broad adoption of pyasn1 across enterprise products (IBM, Oracle, Red Hat, Splunk, Dell) amplifies the potential blast radius (Feedly).

A public proof-of-concept (PoC) script was published as part of the original GitHub Security Advisory, demonstrating memory exhaustion with crafted payloads (GitHub Advisory). No evidence of in-the-wild exploitation or threat actor attribution has been reported as of the time of this report (Feedly). The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No authentication or special privileges are required to exploit this vulnerability over the network.

1. Identify target: Locate a network-accessible service that uses pyasn1 < 0.6.2 to parse untrusted ASN.1 data, such as an LDAP server, TLS endpoint, OCSP responder, or certificate validation service.
2. Craft malicious payload: Construct a DER-encoded ASN.1 packet with a RELATIVE-OID or OID tag containing a large number of continuation octets (bytes with the high bit set, e.g., 0x81 or 0xFF). Example structure: b'\x06' + length_bytes + b'\x81' * N + b'\x00' where N is large (e.g., megabytes).
3. Encode length field: Encode the payload length in DER multi-byte length format to accommodate large payloads (e.g., \x84 followed by 4-byte big-endian length for payloads up to 4 GB).
4. Submit payload: Send the crafted packet to the target service — for example, as a malicious X.509 certificate during a TLS handshake, or as an LDAP request containing the malformed OID.
5. Trigger memory exhaustion: The pyasn1 BER decoder processes the continuation octets in a loop, accumulating an unbounded integer via bit-shifting, causing the process to exhaust available memory and crash or become unresponsive (GitHub Advisory).

• Network: Unusually large ASN.1-encoded packets (megabytes in size) sent to services that process certificates or OIDs (e.g., LDAP port 389/636, OCSP port 80/443, TLS handshake traffic); repeated connection attempts with oversized payloads.
• Process: Rapid and sustained memory growth in the Python process hosting the pyasn1-dependent service; process crash or OOM-killer termination of the service.
• Logs: Application-level errors or unhandled exceptions referencing pyasn1.codec.ber.decoder or MemoryError in Python tracebacks; service restart events following unexpected crashes.
• System: System logs (/var/log/syslog, dmesg) showing OOM (Out of Memory) kill events targeting the affected service process.

The primary remediation is to upgrade pyasn1 to version 0.6.2 or later, which introduces a hard limit of 20 continuation octets per OID arc in the BER decoder (Patch Commit, GitHub Advisory). Downstream consumers should apply vendor-specific patches: Red Hat has issued multiple errata (e.g., RHSA-2026:1903–1906, RHSA-2026:2221, and others); Debian issued DLA-4463-1 and DSA-6114-1; Ubuntu issued USN-8134-1; SUSE, Mageia, Fedora, Oracle Linux, Rocky Linux, and Amazon Linux have also released updates (Feedly). IBM has published advisories for affected products including Business Automation Insights, watsonx Orchestrate, Cloud Pak for Data, and others. As a temporary workaround where patching is not immediately possible, restrict network access to services that parse untrusted ASN.1 data and monitor for abnormal memory consumption.

The vulnerability received broad coverage across Linux distribution security channels, with advisories issued by Red Hat, Debian, Ubuntu, SUSE, Fedora, Oracle Linux, Rocky Linux, Mageia, and Amazon Linux shortly after disclosure (Feedly). IBM published multiple security bulletins addressing the impact on its enterprise products including Maximo Application Suite, watsonx Orchestrate, Cloud Pak for Data, and QRadar Suite (IBM). Oracle included the vulnerability in its April 2026 Critical Patch Update (Oracle CPU). Splunk addressed it in its June 2026 third-party package update advisory (Splunk Advisory). Community reaction was largely focused on patch tracking across distributions rather than active exploitation concerns.