Back Ubuntu

USN-8134-1: pyasn1 vulnerabilities

Ubuntu • March 30, 2026

It was discovered that pyasn1 could exhaust system resources when attempting to decode a malformed certificate. An attacker could possibly use this to cause a denial of service. ( CVE-2026-23490 ) Kevin Tu discovered that pyasn1 could exhaust system resources via uncontrolled recursion when attempting to decode malicously-crafted certificates. An attacker could possibly use this to cause a denial of service. ( CVE-2026-30922 )

It was discovered that pyasn1 could exhaust system resources when attempting to decode a malformed certificate. An attacker could possibly use this to cause a denial of service. ( CVE-2026-23490 )

Kevin Tu discovered that pyasn1 could exhaust system resources via uncontrolled recursion when attempting to decode malicously-crafted certificates. An attacker could possibly use this to cause a denial of service. ( CVE-2026-30922 )

It was discovered that pyasn1 could exhaust system resources when attempting to decode a malformed certificate. An attacker could possibly use this to cause a denial of service. ( CVE-2026-23490 )

In general, a standard system update will make all the necessary changes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple pyasn1 Vulnerabilities Lead to Denial of Service Risks Two vulnerabilities in the pyasn1 library have been identified, allowing attackers to exploit uncontrolled recursion when decoding malformed ASN.1 data. The first vulnerability, CVE-2026-23490, was published on January 16, 2026, and can exhaust system resources, potentially leading to a denial of service. The second vulnerability, CVE-2026-30922, published on March 18, 2026, also allows for resource exhaustion through similar means. Both vulnerabilities can be triggered by specially crafted input, affecting systems that utilize pyasn1 for certificate decoding. Users are advised to update their systems to mitigate these risks. The vulnerabilities pose a significant threat to any systems relying on pyasn1, particularly in environments where certificate validation is critical. The recommended action is to apply standard system updates to ensure protection against these vulnerabilities. 4 sources 58

Extracted Entities

Attack Types (1)

DDoS

CVEs (2)

CVE-2026-23490 CVE-2026-30922