CVE-2026-23490

What it actually does

This is a remotely triggerable denial-of-service weakness in pyasn1 before version 0.6.2. When an application decodes attacker-controlled ASN.1 data containing a malformed RELATIVE-OID with excessive continuation octets, pyasn1 can allocate excessive memory while processing the object identifier encoding. The flaw does not provide confidentiality or integrity impact, but it can exhaust process or host memory, causing the Python application, container, service, or dependent component such as packaged kubevirt builds to crash or be killed by the operating system.

Why it matters to the business

Services that parse ASN.1 data from untrusted sources can be made unavailable with crafted input, potentially causing failed authentication flows, certificate or protocol processing failures, API downtime, degraded virtualization-management workflows where vulnerable kubevirt packages are present, and operational instability from repeated process or container restarts. The issue has a high availability impact but currently has low EPSS, no known CISA KEV listing, no ransomware association, and no reported mature public exploitation, so remediation should be prioritized based on whether ASN.1 parsing is exposed to network, user-uploaded, federation, certificate, SSO, LDAP, SNMP, Kerberos, or other untrusted data paths.

How an attack unfolds

An attacker first identifies a service or workflow that accepts ASN.1-encoded data and processes it through a vulnerable pyasn1 version. The attacker then submits a crafted ASN.1 object containing a RELATIVE-OID value encoded with an excessive number of continuation octets. During decoding, the vulnerable library consumes increasing memory until the process reaches memory limits or the host/container experiences memory pressure. The result is typically a process crash, an out-of-memory kill, degraded performance, or service restart. Repeated requests can keep the affected service unavailable, especially when the parsing endpoint is unauthenticated or exposed to the network.

How to fix it

Upgrade pyasn1 to version 0.6.2 or later wherever it is installed directly or bundled transitively. For source deployments using the upstream Git repository, ensure the fix including commit e7356f89cf32c130d65b1a0e903fe7ecce426424 is present. For SUSE-packaged kubevirt deployments, update affected packages to 1.2.2-150500.8.24.1 or later on the listed SUSE Linux Enterprise Micro 5.5 and SUSE Linux Enterprise 15 SP5 variants. Rebuild and redeploy containers, virtual environments, Python wheels, and vendor images that vendor or pin pyasn1. If immediate upgrade is not possible, reduce exposure by rejecting untrusted ASN.1 inputs where feasible, enforcing strict request/body size limits, applying per-process and per-container memory limits, rate-limiting unauthenticated parsing endpoints, and isolating ASN.1 parsing from critical control-plane services.

How to confirm the fix worked

Confirm installed versions with package inventory and runtime checks, for example by reviewing Python dependency lockfiles, SBOMs, container image manifests, virtual environments, and OS package versions for pyasn1 older than 0.6.2 or affected kubevirt packages older than 1.2.2-150500.8.24.1. Validate that rebuilt artifacts actually include the patched dependency and that no vendored copy of pyasn1 remains. Where safe and authorized, run a controlled negative test against non-production parsing paths to verify malformed ASN.1 input is rejected without abnormal memory growth. Monitor patched services under representative load to confirm memory remains bounded and no OOM kills or restart loops occur.

Typical attack path

1. Identify an application, API, protocol handler, or packaged product that uses pyasn1 before 0.6.2 to decode ASN.1 data.
2. Find an input path that accepts ASN.1-controlled content, such as certificate-like data, authentication messages, protocol packets, uploaded files, or service-to-service messages.
3. Send malformed ASN.1 containing a RELATIVE-OID with excessive continuation octets.
4. Trigger memory growth during pyasn1 decoding.
5. Cause the application process, container, or host-level service to be killed, restarted, or become unresponsive.
6. Repeat the request to sustain a denial of service.

How to detect it

Look for signs of memory exhaustion in services that use pyasn1 or products that bundle it, especially immediately after receiving ASN.1, certificate, identity, LDAP, SNMP, Kerberos, or binary upload traffic. Useful sources include application logs, Python exception logs, container runtime events, Kubernetes events, system journal/syslog, Linux kernel OOM logs, process supervisor logs, API gateway logs, reverse proxy logs, and endpoint telemetry. Correlate inbound requests or uploaded payloads with rapid resident memory growth, worker crashes, container restarts, OOMKilled events, or repeated 500/502/503 responses. Because exploitation may leave few content-level indicators unless payload logging is enabled, focus on behavioral artifacts: abnormal memory consumption by Python processes, repeated restarts of the same service, kernel messages killing Python or dependent service processes, and parsing errors mentioning ASN.1, OID, RelativeOID, or pyasn1 immediately before failure.

• pyasn1
• RELATIVE-OID
• RelativeOID
• ObjectIdentifier
• MemoryError
• Out of memory
• oom-kill
• OOMKilled
• Killed process
• ContainerStatusUnknown
• CrashLoopBackOff
• ExitCode:137
• exit code 137
• signal: killed
• asn1
• ASN.1

What your security team should do

• Inventory all direct and transitive uses of pyasn1, including Python virtual environments, containers, serverless packages, embedded vendor libraries, and OS-distributed packages.
• Prioritize remediation for internet-facing or unauthenticated services that parse ASN.1, certificate-like content, identity/authentication protocol data, LDAP/SNMP/Kerberos-related data, or user-uploaded binary formats.
• Upgrade pyasn1 to 0.6.2 or later and update affected SUSE kubevirt packages to 1.2.2-150500.8.24.1 or later.
• Rebuild and redeploy container images and application bundles rather than only changing dependency manifests.
• Apply memory limits, request size limits, parser timeouts, and rate limits as defense-in-depth for services that process ASN.1 from untrusted sources.
• Add monitoring for sudden memory growth, OOM kills, crash loops, and spikes in ASN.1 parsing errors after public disclosure.
• Review logs for evidence of repeated malformed ASN.1 submissions followed by service instability, especially on exposed endpoints.