Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consumes all available memory (OOM), crashing the host application. This is a distinct vulnerability from CVE-2026-23490 (which addressed integer overflows in OID decoding). The fix for CVE-2026-23490 (`MAX_OID_ARC_CONTINUATION_OCTETS`) does not mitigate this recursion issue. Version 0.6.3 fixes this specific issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pyasn1 | pyasn1 | < 0.6.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pyasn1 | 0.6.3-1 | — |
| Debian 13 | pyasn1 | 0.6.1-1+deb13u2 | — |
| Debian 12 | pyasn1 | 0.4.8-3+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | pyasn1 | 0.6.1-1ubuntu0.2 | — |
| Ubuntu 24.04 LTS | pyasn1 | 0.4.8-4ubuntu0.2 | — |
| Ubuntu 22.04 LTS | pyasn1 | 0.4.8-1ubuntu0.2 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | pyasn1 | 0.4.2-3ubuntu0.20.04.1~esm1 | — |
| Ubuntu Pro 18.04 LTS | pyasn1 | 0.4.2-3ubuntu0.18.04.1~esm1 | — |
| Ubuntu Pro 16.04 LTS | pyasn1 | 0.1.9-1ubuntu0.1~esm1 | — |
| Ubuntu Pro 14.04 LTS | pyasn1 | 0.1.7-1ubuntu2.1+esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | fence-virt +55 | 4.16.0-13.el10_1.4 | RHSA-2026:19138, RHSA-2026:13916 |
| RHEL 9 | fence-virt +56 | 4.10.0-98.el9_7.13 | RHSA-2026:19355, RHSA-2026:13917 |
| RHEL 8 | fence-agents +48 | 4.2.1-129.el8_10.25 | RHSA-2026:12176 |
| RHEL 8 | resource-agents +3 | 4.9.0-54.el8_10.33 | RHSA-2026:13902 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | fence-virt +55 | 4.16.0-5.el10_0.9 | RHSA-2026:17083 |
| RHEL 9.6 EUS | fence-virt +56 | 4.10.0-86.el9_6.17 | RHSA-2026:22970 |
| RHEL 9.4 E4S | fence-virt +56 | 4.10.0-62.el9_4.25 | RHSA-2026:22969 |
| RHEL 9.2 E4S | fence-virt +56 | 4.10.0-43.el9_2.22 | RHSA-2026:22987 |
| RHEL 8.8 TUS | fence-agents +46 | 4.2.1-112.el8_8.17 | RHSA-2026:20588 |
| RHEL 8.8 TUS | resource-agents +3 | 4.9.0-40.el8_8.19 | RHSA-2026:22131 |
| RHEL 8.8 E4S | fence-agents +47 | 4.2.1-112.el8_8.17 | RHSA-2026:20588 |
| RHEL 8.8 E4S | resource-agents +3 | 4.9.0-40.el8_8.19 | RHSA-2026:22131 |
| RHEL 8.6 TUS | fence-agents +46 | 4.2.1-89.el8_6.22 | RHSA-2026:22134 |
| RHEL 8.6 TUS | resource-agents +3 | 4.9.0-16.el8_6.22 | RHSA-2026:22132 |
| RHEL 8.6 E4S | fence-agents +47 | 4.2.1-89.el8_6.22 | RHSA-2026:22134 |
| RHEL 8.6 E4S | resource-agents +3 | 4.9.0-16.el8_6.22 | RHSA-2026:22132 |
| RHEL 8.6 AUS | fence-agents +42 | 4.2.1-89.el8_6.22 | RHSA-2026:22134 |
| RHEL 8.4 EUS Long Life | fence-agents +42 | 4.2.1-65.el8_4.28 | RHSA-2026:22135 |
| RHEL 8.4 EUS Long Life | resource-agents +2 | 4.1.1-90.el8_4.25 | RHSA-2026:22133 |
| RHEL 8.4 AUS | fence-agents +46 | 4.2.1-65.el8_4.28 | RHSA-2026:22135 |
| RHEL 8.4 AUS | resource-agents +2 | 4.1.1-90.el8_4.25 | RHSA-2026:22133 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.4-2.el8ap | RHSA-2026:24762, RHSA-2026:24761, RHSA-2026:13512 |
| Red Hat Ansible Automation Platform Inside 2 | receptorctl | 1.6.4-2.el9ap | RHSA-2026:24762, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.11-2.el9ap | RHSA-2026:24762, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform Developer 2 | python3-click | 8.3.3-1.el10ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.4-2.el8ap | RHSA-2026:24762, RHSA-2026:24761, RHSA-2026:13512 |
| Red Hat Ansible Automation Platform Developer 2 | receptorctl | 1.6.4-2.el9ap | RHSA-2026:24762, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-controller +3 | 4.7.11-2.el9ap | RHSA-2026:24762, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.6.28-3.el8ap | RHSA-2026:24762, RHSA-2026:24761, RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy +1 | 2.5.10-5.el8ap | RHSA-2026:24762, RHSA-2026:24761, RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server +11 | 2.5.20260422-2.el8ap | RHSA-2026:24761, RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.8-1.el9ap | RHSA-2026:24762, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3-click | 8.3.3-1.el10ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3.12-click | 8.3.3-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-cryptography | 46.0.7-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-django-ansible-base+resource_registry | 2.6.20260422-1.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-jwcrypto | 1.5.7-1.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-markdown | 3.10.2-1.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-pillow | 12.2.0-1.el8ap | RHSA-2026:24762, RHSA-2026:24761 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyOpenSSL | 26.0.0-1.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyasn1 | 0.6.3-1.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.12.1-1.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.4-2.el8ap | RHSA-2026:24762, RHSA-2026:24761, RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2 | receptorctl | 1.6.4-2.el9ap | RHSA-2026:24762, RHSA-2026:13508 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | fence-agents-apc +35 | 4.16.0-13.el10_1.4 | ALSA-2026:13916 |
| AlmaLinux 9 | fence-virt +55 | 4.10.0-98.el9_7.13 | ALSA-2026:13917 |
| AlmaLinux 8 | fence-agents-all +47 | 4.2.1-129.el8_10.25 | ALSA-2026:12176 |
| AlmaLinux 8 | resource-agents +3 | 4.9.0-54.el8_10.33 | ALSA-2026:13902 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | fence-agents | 4.16.0-13.el10_1.4 | RLSA-2026:19138, RLSA-2026:13916 |
| Rocky Linux 9 | fence-agents | 4.10.0-98.el9_7.13 | RLSA-2026:19355, RLSA-2026:13917 |
| Rocky Linux 8 | fence-agents | 4.2.1-129.el8_10.25 | RLSA-2026:12176 |
| Rocky Linux 8 | resource-agents | 4.9.0-54.el8_10.33 | RLSA-2026:13902 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1 |
| SLES 15 SP6 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1, SUSE-SU-2026:1075-1 |
| SLES 15 SP5 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1, SUSE-SU-2026:1075-1 |
| SLES 15 SP4 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1, SUSE-SU-2026:1075-1 |
| SLES 12 SP5 | python-pyasn1 | 0.1.9-4.14.1 | SUSE-SU-2026:1076-1 |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 3 | python-pyasn1 | 0.5.0-150400.12.13.1 | SUSE-SU-2026:1075-1 |
| SLES for SAP 16.0 | python-pyasn1 | 0.6.1-160000.4.1 | SUSE-SU-2026:20929-1 |
| SLES for SAP 15 SP6 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1, SUSE-SU-2026:1075-1 |
| SLES for SAP 15 SP5 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1, SUSE-SU-2026:1075-1 |
| SLES for SAP 15 SP4 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1, SUSE-SU-2026:1075-1 |
| SLES 16.0 | python-pyasn1 | 0.6.1-160000.4.1 | SUSE-SU-2026:20929-1 |
| SLE Micro 6.2 | python-pyasn1 | 0.6.1-160000.4.1 | SUSE-SU-2026:20835-1 |
| SLE Micro 6.1 | python-pyasn1 | 0.5.0-slfo.1.1_3.1 | SUSE-SU-2026:20878-1 |
| SLE Micro 6.0 | python-pyasn1 | 0.5.0-4.1 | SUSE-SU-2026:20821-1 |
| SLE Micro 5.5 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1 |
| SLE Micro 5.4 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1 |
| SLE Micro 5.3 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1 |
| SLE Micro 5.2 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1 |
| SLE HPC 15 SP5 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1, SUSE-SU-2026:1075-1 |
| SLE HPC 15 SP4 | python-pyasn1 | 0.4.2-150000.3.16.1 | SUSE-SU-2026:1158-1, SUSE-SU-2026:1075-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-pyasn1 | 0.6.3-1.1 | openSUSE-SU-2026:10393-1 |
| openSUSE Leap 16.0 | python-pyasn1 | 0.6.1-160000.4.1 | openSUSE-SU-2026:20418-1 |
| openSUSE Leap 15.6 | python-pyasn1 | 0.5.0-150400.12.13.1 | SUSE-SU-2026:1075-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-pyasn1 +2 | 0.4.8-4.amzn2023.0.4 | ALAS2023-2026-1538 |
| Amazon Linux 2 | python2-pyasn1 +3 | 0.1.9-7.amzn2.0.4 | ALAS2-2026-3215 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-pyasn1 | 0.4.8-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | fence-virt +52 | 4.16.0-13.el10_1.4 | ELSA-2026-19138, ELSA-2026-13916 |
| Oracle Linux 9 | fence-virt +54 | 4.10.0-98.el9_7.13 | ELSA-2026-19355, ELSA-2026-13917 |
| Oracle Linux 8 | fence-agents-all +41 | 4.2.1-129.el8_10.25 | ELSA-2026-12176 |
| Oracle Linux 8 | resource-agents | 4.9.0-54.el8_10.33 | ELSA-2026-13902 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.1.8-r9 | — |
| Wolfi rolling | datadog-agent-7.72-core-integrations | No fix yet | — |
| Wolfi rolling | datadog-agent-7.73-core-integrations | 7.73.3-r23 | — |
| Wolfi rolling | datadog-agent-7.77-core-integrations | 7.77.3-r5 | — |
| Wolfi rolling | k8s-sidecar | 2.5.1-r2 | — |
| Wolfi rolling | kubeflow-jupyter-web-app | 1.10.0-r13 | — |
| Wolfi rolling | kubeflow-pipelines-apiserver | 2.16.0-r9 | — |
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.16.0-r2 | — |
| Wolfi rolling | kubeflow-volumes-web-app | 1.10.0-r12 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.27.0-r5 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pyasn1 | < 0.6.3 | 0.6.3 | GHSA-jr27-m4p2-rc6r |
Advisories 50
- RHSA-2026:22133 Red Hat Security Advisory: resource-agents security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-0935 Red Hat Ansible Automation Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- WID-SEC-2026-2933 Splunk SOAR: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2026:13917 Important: fence-agents security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:13916 Important: fence-agents security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:13902 Important: resource-agents security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:12176 Important: fence-agents security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-1007 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2026
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- RHSA-2026:24761 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:24762 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:19355 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:13512 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:13508 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:12176 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:19138 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:17083 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:13916 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:22970 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:22987 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:22969 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:22134 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:22135 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:22132 Red Hat Security Advisory: resource-agents security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:22131 Red Hat Security Advisory: resource-agents security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:20588 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:13917 Red Hat Security Advisory: fence-agents security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:13902 Red Hat Security Advisory: resource-agents security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- ELSA-2026-19138 Important: fence-agents security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 17, 2026
- ELSA-2026-19355 Important: fence-agents security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 26, 2026
- RLSA-2026:19355 Important: fence-agents security update Rocky Linux Security Advisories · May 30, 2026
- RLSA-2026:19138 Important: fence-agents security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:13917 Important: fence-agents security update Rocky Linux Security Advisories · May 7, 2026
- RLSA-2026:13916 Important: fence-agents security update Rocky Linux Security Advisories · May 7, 2026
- RLSA-2026:13902 Important: resource-agents security update Rocky Linux Security Advisories · May 7, 2026
- ELSA-2026-13902 Important: resource-agents security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 7, 2026
- ELSA-2026-13917 Important: fence-agents security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 6, 2026
- ELSA-2026-13916 Important: fence-agents security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · May 6, 2026
- RLSA-2026:12176 Important: fence-agents security update Rocky Linux Security Advisories · Apr 30, 2026
- ELSA-2026-12176 Important: fence-agents security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 30, 2026
- ALAS2023-2026-1538 Moderate: python-pyasn1 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 13, 2026
- SUSE-SU-2026:20929-1 Security update for python-pyasn1 SUSE / openSUSE Security Updates · Apr 2, 2026
- ALAS2-2026-3215 Moderate: python-pyasn1 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 1, 2026
- SUSE-SU-2026:1158-1 Security update for python-pyasn1 SUSE / openSUSE Security Updates · Apr 1, 2026
- SUSE-SU-2026:20878-1 Security update for python-pyasn1 SUSE / openSUSE Security Updates · Mar 31, 2026
- openSUSE-SU-2026:20418-1 Security update for python-pyasn1 SUSE / openSUSE Security Updates · Mar 29, 2026
- SUSE-SU-2026:20835-1 Security update for python-pyasn1 SUSE / openSUSE Security Updates · Mar 28, 2026
- SUSE-SU-2026:1075-1 Security update for python-pyasn1 SUSE / openSUSE Security Updates · Mar 27, 2026
- SUSE-SU-2026:1076-1 Security update for python-pyasn1 SUSE / openSUSE Security Updates · Mar 27, 2026
- SUSE-SU-2026:20821-1 Security update for python-pyasn1 SUSE / openSUSE Security Updates · Mar 26, 2026