CVE-2026-23490

Infinite Mass: The Python OID Memory Hole

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 17, 2026·6 min read·10 visits

Executive Summary (TL;DR)

The `pyasn1` library, used extensively in Python cryptography and networking stacks, failed to limit the length of Object Identifiers (OIDs) during decoding. By exploiting the Variable-Length Quantity (VLQ) encoding, an attacker can force the decoder to construct an infinitely large integer, consuming all available system RAM and crashing the process (DoS) via a single malformed packet.

A deep dive into how a 40-year-old encoding standard (ASN.1) combined with Python's infinite-precision integers to create a trivial, unauthenticated Denial of Service vector in the `pyasn1` library.

Fix Analysis (1)

Technical Appendix

CVSS Score
7.5/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Probability
0.04%
Top 89% most exploited

Affected Systems

LDAP Servers (Python-based)SNMP Agents/ManagersCustom TLS/SSL Handshake ProcessorsX.509 Certificate ParsersOCSP Responders

Affected Versions Detail

Product
Affected Versions
Fixed Version
pyasn1
pyasn1
< 0.6.20.6.2
AttributeDetail
CWECWE-770 (Allocation of Resources Without Limits)
CVSS v3.17.5 (High)
Attack VectorNetwork (Remote)
Privileges RequiredNone
User InteractionNone
EPSS Score0.00038
CWE-770
Allocation of Resources Without Limits or Throttling

The software allocates resources without limits or throttling, which can cause the consumption of all available resources.

Vulnerability Timeline

Patch Committed
2024-06-15
Version 0.6.2 Released
2024-06-18

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.