Back Linuxsecurity

Ubuntu 20.04 LTS Pyasn1 High Risk DoS Vulnerabilities USN-8134

Linuxsecurity •LinuxSecurity Advisories • March 31, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in pyasn1. Software Description: - pyasn1: ASN.1 library for Python Details: It was discovered that pyasn1 could exhaust system resources when attempting to decode a malformed certificate. An attacker could possibly use this to cause a denial of service. (CVE-2026-23490) Kevin Tu discovered that pyasn1 could exhaust system resources via uncontrolled recursion when attempting to decode malicously-crafted certificates. An attacker could possibly use this to cause a denial of service. (CVE-2026-30922)

The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS pypy-pyasn1 0.4.2-3ubuntu0.20.04.1~esm1 Available with Ubuntu Pro python-pyasn1 0.4.2-3ubuntu0.20.04.1~esm1 Available with Ubuntu Pro python3-pyasn1 0.4.2-3ubuntu0.20.04.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS pypy-pyasn1 0.4.2-3ubuntu0.18.04.1~esm1 Available with Ubuntu Pro python-pyasn1 0.4.2-3ubuntu0.18.04.1~esm1 Available with Ubuntu Pro python3-pyasn1 0.4.2-3ubuntu0.18.04.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS pypy-pyasn1 0.1.9-1ubuntu0.1~esm1 Available with Ubuntu Pro python-pyasn1 0.1.9-1ubuntu0.1~esm1 Available with Ubuntu Pro python3-pyasn1 0.1.9-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 14.04 LTS python-pyasn1 0.1.7-1ubuntu2.1+esm1 Available with Ubuntu Pro python3-pyasn1 0.1.7-1ubuntu2.1+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2026-23490, CVE-2026-30922

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple pyasn1 Vulnerabilities Lead to Denial of Service Risks Two vulnerabilities in the pyasn1 library have been identified, allowing attackers to exploit uncontrolled recursion when decoding malformed ASN.1 data. The first vulnerability, CVE-2026-23490, was published on January 16, 2026, and can exhaust system resources, potentially leading to a denial of service. The second vulnerability, CVE-2026-30922, published on March 18, 2026, also allows for resource exhaustion through similar means. Both vulnerabilities can be triggered by specially crafted input, affecting systems that utilize pyasn1 for certificate decoding. Users are advised to update their systems to mitigate these risks. The vulnerabilities pose a significant threat to any systems relying on pyasn1, particularly in environments where certificate validation is critical. The recommended action is to apply standard system updates to ensure protection against these vulnerabilities. 4 sources 58

Extracted Entities

Ubuntu 20.04 LTS Pyasn1 High Risk DoS Vulnerabilities USN-8134

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)