Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
pyasn1 Certificate Decoding Causes System Resource Exhaustion
published 7 months ago
Summary
A software library used for working with certificates has a bug that can cause it to consume all available system resources. This could be exploited by an attacker to make the system unusable. To protect your system, update the software library to the latest version.
What to do
- Update canonical pyasn1 to version 0.1.7-1ubuntu2.1+esm1.
- Update canonical pyasn1 to version 0.1.9-1ubuntu0.1~esm1.
- Update canonical pyasn1 to version 0.4.2-3ubuntu0.18.04.1~esm1.
- Update canonical pyasn1 to version 0.4.2-3ubuntu0.20.04.1~esm1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | pyasn1 |
< 0.1.7-1ubuntu2.1+esm1 Fix: upgrade to 0.1.7-1ubuntu2.1+esm1
|
| Ubuntu:Pro:16.04:LTS | canonical | pyasn1 |
< 0.1.9-1ubuntu0.1~esm1 Fix: upgrade to 0.1.9-1ubuntu0.1~esm1
|
| Ubuntu:Pro:18.04:LTS | canonical | pyasn1 |
< 0.4.2-3ubuntu0.18.04.1~esm1 Fix: upgrade to 0.4.2-3ubuntu0.18.04.1~esm1
|
| Ubuntu:Pro:20.04:LTS | canonical | pyasn1 |
< 0.4.2-3ubuntu0.20.04.1~esm1 Fix: upgrade to 0.4.2-3ubuntu0.20.04.1~esm1
|
Original advisory text
pyasn1 vulnerabilities
It was discovered that pyasn1 could exhaust system resources when
attempting to decode a malformed certificate. An attacker could
possibly use this to cause a denial of service. (CVE-2026-23490)
Kevin Tu discovered that pyasn1 could exhaust system resources via
uncontrolled recursion when attempting to decode malicously-crafted
certificates. An attacker could possibly use this to cause a denial of
service. (CVE-2026-30922)
attempting to decode a malformed certificate. An attacker could
possibly use this to cause a denial of service. (CVE-2026-23490)
Kevin Tu discovered that pyasn1 could exhaust system resources via
uncontrolled recursion when attempting to decode malicously-crafted
certificates. An attacker could possibly use this to cause a denial of
service. (CVE-2026-30922)
References
- https://ubuntu.com/security/notices/USN-8134-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-23490 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-30922 Third Party Advisory
Timeline
Published30 Mar 2026
Updated15 Jul 2026
First seen15 Jul 2026
Sources
USN-8134-1 · OSV
Track software like this
Free during beta