CVE-2026-23490High· 7.5▾ MidnightPoC availablepyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Last analysed / modified upstream
0.7% → 0.8%
Exploit / PoC code exists
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.
pyasn1 < 0.6.2debian_linux = 11.0Upgrade past the affected range:
pyasn1 0.6.2Affected packages:
pyasn1 >= 0.6.1, < 0.6.2Patched in:
pyasn1 0.6.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-69223High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2025-69228High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2025-61726High· 7.5The net/url package does not set a limit on the number of query parameters in a query
CVE-2026-101917Medium· 5.3PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-100650Medium· 6.5vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-p…
CVE-2026-100350Medium· 5.3kin-openapi is a Go project for handling OpenAPI files