pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-agents-ibmbladeUpgrade fence-agents-ilo-mpUpgrade fence-agents-heuristics-pingUpgrade fence-agents-redfishUpgrade fence-agents-computeUpgrade fence-virtdUpgrade fence-agents-virshUpgrade fence-agents-wtiUpgrade fence-virtd-tcpUpgrade fence-agents-bladecenterUpgrade fence-agents-ipmilanUpgrade fence-agents-kubevirtUpgrade fence-agents-gceUpgrade fence-agents-azure-armUpgrade fence-agents-allUpgrade ha-cloud-supportUpgrade fence-agents-rsaUpgrade fence-agents-ilo2Upgrade fence-agents-drac5Upgrade fence-agents-mpathUpgrade fence-agents-cisco-mdsUpgrade fence-agents-ibm-vpcUpgrade fence-virtd-serialUpgrade fence-agents-ibm-powervsUpgrade fence-agents-awsUpgrade fence-agents-ilo-moonshotUpgrade fence-virtd-cpgUpgrade fence-virtd-libvirtUpgrade fence-agents-epsUpgrade fence-agents-rhevmUpgrade fence-agents-ilo-sshUpgrade resource-agents-aliyunUpgrade fence-agents-ifmibUpgrade fence-agents-aliyunUpgrade fence-agents-brocadeUpgrade fence-agents-cisco-ucsUpgrade fence-agents-hpbladeUpgrade fence-virtUpgrade fence-agents-ipduUpgrade fence-agents-emersonUpgrade fence-agents-openstackUpgrade fence-agents-amt-wsUpgrade fence-agents-eaton-snmpUpgrade resource-agents-gcpUpgrade fence-agents-commonUpgrade fence-agents-vmware-restUpgrade fence-agents-intelmodularUpgrade resource-agentsUpgrade fence-agents-lparUpgrade fence-agents-sbdUpgrade fence-agents-apc-snmpUpgrade fence-agents-vmware-soapUpgrade fence-agents-kdumpUpgrade fence-agents-nutanix-ahvUpgrade fence-virtd-multicastUpgrade fence-agents-zvmUpgrade fence-agents-rsbUpgrade fence-agents-apcUpgrade fence-agents-scsiUpgrade resource-agents-paf | May 3, 2026 | Apr 30, 2026 |
| Amazon Linux Ami 2 | — | Upgrade python2-pyasn1-modulesUpgrade python2-pyasn1Upgrade python3-pyasn1Upgrade python3-pyasn1-modules | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade pyasn1 | Apr 6, 2026 | Apr 6, 2026 |
| Oracle_linux | — | Upgrade fence-virtd-tcpUpgrade fence-agents-emersonUpgrade fence-virtdUpgrade fence-agents-kdumpUpgrade fence-agents-bladecenterUpgrade fence-virtd-cpgUpgrade fence-agents-sbdUpgrade fence-agents-rsaUpgrade fence-agents-awsUpgrade fence-agents-virshUpgrade resource-agentsUpgrade fence-agents-ilo-sshUpgrade fence-agents-amt-wsUpgrade fence-agents-cisco-ucsUpgrade fence-agents-apc-snmpUpgrade fence-agents-openstackUpgrade fence-agents-rhevmUpgrade fence-agents-commonUpgrade fence-agents-vmware-soapUpgrade fence-agents-rsbUpgrade fence-agents-epsUpgrade fence-agents-drac5Upgrade fence-agents-ilo-moonshotUpgrade fence-agents-cisco-mdsUpgrade fence-agents-eaton-snmpUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-computeUpgrade fence-agents-azure-armUpgrade fence-agents-ibm-powervsUpgrade fence-agents-ilo2Upgrade fence-agents-ibm-vpcUpgrade ha-cloud-supportUpgrade fence-virtd-multicastUpgrade fence-agents-ibmbladeUpgrade fence-agents-ipduUpgrade fence-agents-aliyunUpgrade fence-agents-mpathUpgrade fence-agents-ifmibUpgrade fence-agents-intelmodularUpgrade fence-agents-vmware-restUpgrade fence-agents-allUpgrade fence-virtd-libvirtUpgrade fence-virtUpgrade fence-agents-scsiUpgrade fence-agents-heuristics-pingUpgrade fence-agents-brocadeUpgrade fence-agents-kubevirtUpgrade fence-agents-ilo-mpUpgrade fence-agents-apcUpgrade fence-agents-ipmilanUpgrade fence-agents-wtiUpgrade fence-agents-redfishUpgrade fence-agents-hpbladeUpgrade fence-virtd-serialUpgrade fence-agents-gceUpgrade fence-agents-lpar | May 4, 2026 | Mar 18, 2026 |
| Redhat_linux | — | Upgrade fence-agents-kdumpUpgrade fence-agents-ibm-powervsUpgrade python3.12-cryptography-debuginfoUpgrade python3.12-django-ansible-base+rbacUpgrade fence-agents-virshUpgrade automation-gatewayUpgrade python3.12-django-ansible-baseUpgrade resource-agentsUpgrade automation-gateway-proxy-serverUpgrade fence-agents-azure-armUpgrade fence-agents-amt-wsUpgrade python3.12-django-ansible-base+feature_flagsUpgrade fence-virtd-cpg-debuginfoUpgrade python3.12-django-ansible-base+redis_clientUpgrade fence-agents-allUpgrade automation-gateway-proxyUpgrade automation-controller-venv-towerUpgrade ansible-lintUpgrade python3.12-pyasn1-modulesUpgrade fence-agents-cisco-mdsUpgrade fence-virt-debuginfoUpgrade fence-agents-ifmibUpgrade python3.12-django-ansible-base+activitystreamUpgrade fence-agents-epsUpgrade python3.12-pytokens-debugsourceUpgrade fence-agents-commonUpgrade automation-gateway-proxy-server-debuginfoUpgrade python3.12-blackUpgrade automation-eda-controller-event-stream-servicesUpgrade fence-agents-common-debuginfoUpgrade fence-agents-awsUpgrade fence-agents-mpathUpgrade fence-agents-apc-snmpUpgrade receptorUpgrade fence-virtd-tcp-debuginfoUpgrade fence-agents-computeUpgrade fence-agents-sbdUpgrade automation-controller-uiUpgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-ilo-sshUpgrade fence-agents-rhevmUpgrade fence-agents-ilo-moonshotUpgrade python3.12-cffi-debuginfoUpgrade fence-agents-eaton-snmpUpgrade automation-controller-serverUpgrade fence-agents-nutanix-ahvUpgrade automation-controllerUpgrade fence-virtd-debuginfoUpgrade python3.12-django-ansible-base+api_documentationUpgrade fence-virtdUpgrade resource-agents-debuginfoUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3-pytokensUpgrade resource-agents-gcpUpgrade fence-agents-rsbUpgrade python3.12-pyasn1Upgrade python3.12-django-ansible-base+resource_registryUpgrade fence-virtd-multicastUpgrade fence-agents-vmware-soapUpgrade fence-agents-bladecenterUpgrade fence-agents-cisco-ucsUpgrade fence-virtd-tcpUpgrade automation-controller-cliUpgrade fence-virtUpgrade python3.12-galaxy-importerUpgrade fence-agents-brocadeUpgrade fence-agents-emersonUpgrade fence-agents-kubevirt-debuginfoUpgrade python3.12-cryptography-debugsourceUpgrade yamllintUpgrade fence-virtd-multicast-debuginfoUpgrade receptorctlUpgrade fence-agents-ibm-vpcUpgrade fence-virtd-cpgUpgrade python3.12-dynaconfUpgrade automation-eda-controller-base-servicesUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-jwcryptoUpgrade fence-agents-ipduUpgrade fence-virtd-libvirtUpgrade fence-agents-debuginfoUpgrade python3-wheel-wheelUpgrade fence-agents-kdump-debuginfoUpgrade automation-gateway-serverUpgrade automation-eda-controller-worker-servicesUpgrade python-pytokens-debugsourceUpgrade fence-agents-intelmodularUpgrade resource-agents-debugsourceUpgrade fence-agents-ilo-mpUpgrade fence-virtd-serialUpgrade resource-agents-pafUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade python3-pytokens-debuginfoUpgrade fence-agents-aliyunUpgrade python3.12-pyjwt+cryptoUpgrade python3.12-pytokensUpgrade python3.12-pysequoiaUpgrade python3.12-markdownUpgrade python3.12-cryptographyUpgrade fence-agents-ilo2Upgrade automation-gateway-proxy-debugsourceUpgrade resource-agents-aliyunUpgrade receptor-debuginfoUpgrade fence-agents-heuristics-pingUpgrade fence-agents-hpbladeUpgrade python3.12-pyjwtUpgrade python3.12-pulp-containerUpgrade fence-agents-drac5Upgrade automation-hubUpgrade fence-agents-ibmbladeUpgrade python3.12-cffi-debugsourceUpgrade python3.12-pyOpenSSLUpgrade fence-agents-rsaUpgrade python3.12-pulpcoreUpgrade fence-agents-apcUpgrade resource-agents-aliyun-debuginfoUpgrade fence-agents-redfishUpgrade automation-platform-uiUpgrade python3.12-django-ansible-base+authenticationUpgrade ha-cloud-support-debuginfoUpgrade ansible-coreUpgrade fence-agents-lparUpgrade fence-agents-ipmilanUpgrade ansible-testUpgrade automation-gateway-configUpgrade automation-eda-controllerUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-zvmUpgrade fence-virtd-libvirt-debuginfoUpgrade python3-blackUpgrade python3.12-pysequoia-debuginfoUpgrade python3.12-pathspecUpgrade python3.12-galaxy-ngUpgrade python3.12-django-ansible-base+channel_authUpgrade ha-cloud-supportUpgrade fence-agents-scsiUpgrade fence-agents-kubevirtUpgrade python3.12-cffiUpgrade receptor-debugsourceUpgrade fence-agents-gceUpgrade python3.12-pytokens-debuginfoUpgrade python3.12-pysequoia-debugsourceUpgrade python3-pathspecUpgrade automation-eda-controller-baseUpgrade fence-agents-wtiUpgrade fence-agents-openstackUpgrade fence-agents-debugsourceUpgrade fence-agents-vmware-rest | May 4, 2026 | Mar 18, 2026 |
| Rocky_linux | — | Upgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-awsUpgrade fence-agents-allUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-debugsourceUpgrade fence-agents-commonUpgrade resource-agents-debuginfoUpgrade fence-virtdUpgrade fence-virtd-cpg-debuginfoUpgrade resource-agents-gcpUpgrade fence-agents-common-debuginfoUpgrade resource-agents-pafUpgrade fence-agents-computeUpgrade fence-agents-zvmUpgrade fence-virtd-cpgUpgrade fence-virtd-multicastUpgrade resource-agents-aliyunUpgrade fence-agents-openstackUpgrade resource-agentsUpgrade fence-virtUpgrade fence-virt-debuginfoUpgrade fence-agents-kdumpUpgrade fence-virtd-serial-debuginfoUpgrade fence-virtd-debuginfoUpgrade fence-virtd-serialUpgrade fence-agents-azure-armUpgrade fence-agents-gceUpgrade fence-agents-aliyunUpgrade fence-virtd-libvirtUpgrade fence-virtd-libvirt-debuginfoUpgrade resource-agents-aliyun-debuginfoUpgrade fence-virtd-tcp-debuginfoUpgrade fence-agents-redfishUpgrade fence-agents-debuginfoUpgrade fence-virtd-multicast-debuginfoUpgrade ha-cloud-support-debuginfoUpgrade ha-cloud-supportUpgrade fence-virtd-tcpUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-kdump-debuginfoUpgrade resource-agents-debugsourceUpgrade fence-agents-kubevirt | May 4, 2026 | Apr 30, 2026 |
| Ubuntu | — | Upgrade python-pyasn1 (Ubuntu Pro)Upgrade python3-pyasn1Upgrade python3-pyasn1 (Ubuntu Pro)Upgrade pypy-pyasn1 (Ubuntu Pro) | Mar 31, 2026 | Mar 18, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 18, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub