pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fence-agents-virshUpgrade fence-agents-drac5Upgrade fence-agents-ilo2Upgrade fence-agents-cisco-mdsUpgrade fence-agents-mpathUpgrade fence-agents-ibm-powervsUpgrade fence-agents-rsaUpgrade fence-agents-ipmilanUpgrade fence-agents-ilo-mpUpgrade fence-agents-kubevirtUpgrade fence-agents-computeUpgrade fence-virtd-tcpUpgrade fence-agents-heuristics-pingUpgrade fence-agents-redfishUpgrade fence-virtdUpgrade fence-agents-bladecenterUpgrade fence-virtd-serialUpgrade fence-agents-wtiUpgrade ha-cloud-supportUpgrade fence-agents-allUpgrade fence-agents-ibm-vpcUpgrade fence-agents-azure-armUpgrade fence-agents-gceUpgrade fence-agents-ibmbladeUpgrade fence-virtUpgrade fence-agents-apc-snmpUpgrade fence-agents-rhevmUpgrade fence-agents-aliyunUpgrade fence-agents-brocadeUpgrade fence-agents-openstackUpgrade fence-agents-zvmUpgrade fence-agents-intelmodularUpgrade fence-virtd-multicastUpgrade fence-agents-rsbUpgrade fence-agents-kdumpUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-ilo-sshUpgrade fence-agents-apcUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-vmware-soapUpgrade fence-agents-vmware-restUpgrade fence-agents-hpbladeUpgrade resource-agentsUpgrade fence-agents-lparUpgrade fence-agents-scsiUpgrade fence-agents-ifmibUpgrade resource-agents-gcpUpgrade fence-agents-amt-wsUpgrade fence-agents-cisco-ucsUpgrade fence-agents-sbdUpgrade fence-agents-ipduUpgrade fence-agents-awsUpgrade resource-agents-aliyunUpgrade fence-virtd-cpgUpgrade fence-agents-eaton-snmpUpgrade fence-agents-emersonUpgrade fence-agents-epsUpgrade fence-virtd-libvirtUpgrade resource-agents-pafUpgrade fence-agents-common | May 3, 2026 | Apr 30, 2026 |
| Amazon Linux Ami 2 | — | Upgrade python3-pyasn1-modulesUpgrade python3-pyasn1Upgrade python2-pyasn1-modulesUpgrade python2-pyasn1 | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade pyasn1 | Apr 6, 2026 | Apr 6, 2026 |
| Oracle_linux | — | Upgrade fence-agents-rsbUpgrade fence-agents-cisco-mdsUpgrade fence-agents-ibm-powervsUpgrade fence-agents-ibm-vpcUpgrade fence-virtd-tcpUpgrade fence-agents-eaton-snmpUpgrade fence-agents-kdumpUpgrade fence-agents-epsUpgrade fence-agents-apc-snmpUpgrade fence-agents-sbdUpgrade fence-virtd-cpgUpgrade fence-agents-drac5Upgrade fence-agents-emersonUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-computeUpgrade fence-agents-ilo-sshUpgrade fence-agents-virshUpgrade fence-agents-bladecenterUpgrade fence-agents-cisco-ucsUpgrade resource-agentsUpgrade fence-agents-amt-wsUpgrade fence-agents-ilo-moonshotUpgrade fence-agents-awsUpgrade fence-agents-rsaUpgrade fence-agents-commonUpgrade fence-agents-vmware-soapUpgrade fence-agents-azure-armUpgrade fence-agents-ilo2Upgrade fence-agents-openstackUpgrade fence-agents-rhevmUpgrade fence-virtdUpgrade fence-agents-brocadeUpgrade fence-virtd-libvirtUpgrade fence-agents-hpbladeUpgrade fence-agents-redfishUpgrade fence-agents-ipduUpgrade fence-agents-heuristics-pingUpgrade fence-agents-gceUpgrade ha-cloud-supportUpgrade fence-agents-aliyunUpgrade fence-agents-lparUpgrade fence-agents-vmware-restUpgrade fence-agents-mpathUpgrade fence-agents-intelmodularUpgrade fence-agents-ifmibUpgrade fence-agents-allUpgrade fence-virtd-serialUpgrade fence-agents-scsiUpgrade fence-agents-kubevirtUpgrade fence-virtd-multicastUpgrade fence-agents-ilo-mpUpgrade fence-agents-wtiUpgrade fence-agents-apcUpgrade fence-agents-ibmbladeUpgrade fence-agents-ipmilanUpgrade fence-virt | May 4, 2026 | Mar 18, 2026 |
| Redhat_linux | — | Upgrade fence-virtd-libvirt-debuginfoUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-ipmilanUpgrade python3-wheel-wheelUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-rsaUpgrade ha-cloud-support-debuginfoUpgrade fence-agents-apcUpgrade fence-agents-debuginfoUpgrade python3.12-django-ansible-base+authenticationUpgrade fence-agents-heuristics-pingUpgrade fence-agents-hpbladeUpgrade automation-eda-controller-baseUpgrade fence-agents-lparUpgrade python3-pathspecUpgrade fence-agents-intelmodularUpgrade resource-agents-aliyun-debuginfoUpgrade python3.12-cffi-debugsourceUpgrade python3.12-pysequoia-debugsourceUpgrade python3.12-pysequoia-debuginfoUpgrade python3.12-pulpcoreUpgrade fence-virtd-libvirtUpgrade python3.12-pyOpenSSLUpgrade automation-gateway-proxy-debugsourceUpgrade ansible-coreUpgrade fence-agents-ilo-mpUpgrade python3.12-pysequoiaUpgrade fence-virtd-serialUpgrade python3-blackUpgrade automation-gateway-configUpgrade python3.12-django-ansible-base+channel_authUpgrade automation-eda-controllerUpgrade python3.12-pyjwtUpgrade fence-agents-aliyunUpgrade automation-eda-controller-worker-servicesUpgrade python3.12-pulp-containerUpgrade fence-agents-kubevirtUpgrade receptor-debuginfoUpgrade fence-agents-redfishUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade fence-agents-ilo2Upgrade automation-platform-uiUpgrade fence-agents-wtiUpgrade fence-agents-ibmbladeUpgrade receptor-debugsourceUpgrade fence-agents-vmware-restUpgrade resource-agents-pafUpgrade fence-agents-debugsourceUpgrade python3.12-pytokens-debuginfoUpgrade fence-agents-gceUpgrade python3.12-pytokensUpgrade python3-pytokens-debuginfoUpgrade ha-cloud-supportUpgrade python3.12-pyjwt+cryptoUpgrade fence-agents-openstackUpgrade python3.12-cryptographyUpgrade python3.12-markdownUpgrade resource-agents-aliyunUpgrade fence-agents-scsiUpgrade python3.12-cffiUpgrade python-pytokens-debugsourceUpgrade resource-agents-debugsourceUpgrade automation-gateway-serverUpgrade python3.12-galaxy-ngUpgrade python3.12-pathspecUpgrade fence-agents-drac5Upgrade automation-hubUpgrade fence-agents-zvmUpgrade ansible-testUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-virshUpgrade automation-gatewayUpgrade automation-controller-uiUpgrade fence-agents-ilo-sshUpgrade fence-agents-emersonUpgrade python3.12-django-ansible-base+activitystreamUpgrade receptorctlUpgrade fence-agents-commonUpgrade fence-virtd-cpg-debuginfoUpgrade fence-agents-allUpgrade fence-agents-azure-armUpgrade fence-agents-cisco-mdsUpgrade automation-gateway-proxy-serverUpgrade python3.12-django-ansible-base+redis_clientUpgrade automation-gateway-proxyUpgrade fence-agents-awsUpgrade python3-pytokensUpgrade python3.12-cryptography-debuginfoUpgrade python3.12-jwcryptoUpgrade fence-agents-sbdUpgrade fence-agents-ipduUpgrade automation-eda-controller-event-stream-servicesUpgrade fence-agents-common-debuginfoUpgrade automation-gateway-proxy-server-debuginfoUpgrade fence-virt-debuginfoUpgrade python3.12-django-ansible-baseUpgrade python3.12-pytokens-debugsourceUpgrade ansible-lintUpgrade fence-agents-amt-wsUpgrade python3.12-django-ansible-base+feature_flagsUpgrade python3.12-django-ansible-base+rbacUpgrade fence-agents-kdumpUpgrade fence-agents-epsUpgrade fence-agents-brocadeUpgrade fence-agents-ibm-vpcUpgrade automation-eda-controller-base-servicesUpgrade yamllintUpgrade fence-virtd-cpgUpgrade fence-virtUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-virtd-multicast-debuginfoUpgrade python3.12-dynaconfUpgrade python3.12-cffi-debuginfoUpgrade automation-controller-serverUpgrade resource-agents-gcpUpgrade fence-agents-ibm-powervsUpgrade resource-agentsUpgrade fence-agents-nutanix-ahvUpgrade fence-agents-mpathUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade automation-controller-venv-towerUpgrade fence-virtd-tcp-debuginfoUpgrade python3.12-pyasn1-modulesUpgrade python3.12-pyasn1Upgrade receptorUpgrade fence-agents-vmware-soapUpgrade fence-agents-bladecenterUpgrade fence-virtdUpgrade fence-agents-rhevmUpgrade resource-agents-debuginfoUpgrade fence-agents-ifmibUpgrade fence-virtd-multicastUpgrade automation-controllerUpgrade python3.12-django-ansible-base+rest_filtersUpgrade fence-agents-eaton-snmpUpgrade fence-agents-ilo-moonshotUpgrade python3.12-cryptography-debugsourceUpgrade python3.12-galaxy-importerUpgrade fence-agents-apc-snmpUpgrade fence-agents-computeUpgrade fence-agents-aliyun-debuginfoUpgrade automation-controller-cliUpgrade python3.12-django-ansible-base+resource_registryUpgrade fence-agents-cisco-ucsUpgrade python3.12-blackUpgrade python3.12-django-ansible-base+api_documentationUpgrade fence-virtd-debuginfoUpgrade fence-agents-rsbUpgrade fence-virtd-tcp | May 4, 2026 | Mar 18, 2026 |
| Rocky_linux | — | Upgrade resource-agents-aliyunUpgrade fence-virtd-cpgUpgrade fence-virtd-multicastUpgrade fence-virtUpgrade resource-agentsUpgrade resource-agents-pafUpgrade fence-agents-openstackUpgrade fence-agents-computeUpgrade fence-agents-zvmUpgrade fence-virtdUpgrade fence-agents-kubevirt-debuginfoUpgrade fence-agents-awsUpgrade fence-agents-commonUpgrade fence-agents-common-debuginfoUpgrade fence-agents-allUpgrade fence-virt-debuginfoUpgrade fence-virtd-cpg-debuginfoUpgrade resource-agents-debuginfoUpgrade fence-agents-debugsourceUpgrade fence-agents-aliyun-debuginfoUpgrade fence-agents-kdumpUpgrade resource-agents-gcpUpgrade fence-virtd-serial-debuginfoUpgrade fence-agents-kubevirtUpgrade resource-agents-debugsourceUpgrade fence-agents-debuginfoUpgrade fence-virtd-multicast-debuginfoUpgrade fence-virtd-serialUpgrade fence-agents-azure-arm-debuginfoUpgrade fence-agents-azure-armUpgrade ha-cloud-supportUpgrade fence-virtd-tcpUpgrade fence-virtd-libvirtUpgrade fence-agents-aliyunUpgrade resource-agents-aliyun-debuginfoUpgrade fence-virtd-libvirt-debuginfoUpgrade fence-virtd-debuginfoUpgrade fence-agents-gceUpgrade ha-cloud-support-debuginfoUpgrade fence-agents-kdump-debuginfoUpgrade fence-agents-redfishUpgrade fence-virtd-tcp-debuginfo | May 4, 2026 | Apr 30, 2026 |
| Ubuntu | — | Upgrade pypy-pyasn1 (Ubuntu Pro)Upgrade python3-pyasn1Upgrade python-pyasn1 (Ubuntu Pro)Upgrade python3-pyasn1 (Ubuntu Pro) | Mar 31, 2026 | Mar 18, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 18, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub