7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23490

CVE-2026-23490: pyasn1 has a DoS vulnerability in decoder

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23490

CVE-2026-23490:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pyasn1	pip	= 0.6.1	0.6.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service (DoS) in pyasn1 version 0.6.1 caused by memory exhaustion when decoding malformed OID or RELATIVE-OID values. The root cause is an unbounded loop in the valueDecoder methods of the ObjectIdentifierPayloadDecoder and RelativeOIDPayloadDecoder classes within pyasn1/codec/ber/decoder.py.

When decoding an OID or RELATIVE-OID, the components (arcs) are parsed from bytes. An arc can be represented by multiple bytes, where the high bit of a byte indicates that the next byte is also part of the same arc (a continuation octet). An attacker can craft a payload with an extremely long sequence of these continuation octets for a single arc.

The vulnerable valueDecoder functions would enter a while loop to process these continuation octets. Without any limits, this loop would continue to execute, each time performing bit-shifting and addition to an integer variable (subId). This results in an astronomically large integer being created, consuming a significant amount of memory and CPU, leading to a DoS.

The patch mitigates this by introducing a counter (continuationOctetCount) inside the loop and checking it against a new limit (MAX_OID_ARC_CONTINUATION_OCTETS = 20). If the number of continuation octets exceeds this limit, an exception is raised, terminating the decoding process and preventing resource exhaustion.

The identified vulnerable functions, ObjectIdentifierPayloadDecoder.valueDecoder and RelativeOIDPayloadDecoder.valueDecoder, are the specific methods where this unbounded loop existed. Any application using pyasn1 to decode ASN.1 data from untrusted sources (like X.509 certificates) could trigger this vulnerability. A runtime profile during such an event would show significant time spent within these valueDecoder functions.

Vulnerable functions

ObjectIdentifierPayloadDecoder.valueDecoder

pyasn1/codec/ber/decoder.py

This function decodes Object Identifier (OID) values from a BER-encoded byte stream. It was vulnerable to a denial-of-service attack because it did not limit the number of continuation octets for an OID arc. An attacker could provide a malformed OID with an excessive number of continuation bytes, causing the `while` loop to iterate indefinitely, leading to the creation of an extremely large integer and exhausting system memory.

RelativeOIDPayloadDecoder.valueDecoder

pyasn1/codec/ber/decoder.py

This function decodes Relative Object Identifier (RELATIVE-OID) values from a BER-encoded byte stream. It was vulnerable to a denial-of-service attack because it did not limit the number of continuation octets for a RELATIVE-OID arc. An attacker could provide a malformed RELATIVE-OID with an excessive number of continuation bytes, causing the `while` loop to iterate indefinitely, leading to the creation of an extremely large integer and exhausting system memory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.