Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0021

NIXPKGS-2026-0021
published on
Permalink CVE-2026-23490
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
updated 2 months, 3 weeks ago by @LeSuisse Activity log
  • Created automatic suggestion
  • @LeSuisse removed package python312Packages.pysnmp-pyasn1
  • @LeSuisse removed package python313Packages.pysnmp-pyasn1
  • @LeSuisse removed package python312Packages.pyasn1-modules
  • @LeSuisse removed package python313Packages.pyasn1-modules
  • @LeSuisse accepted
  • @LeSuisse published on GitHub
pyasn1 has a DoS vulnerability in decoder

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

Affected products

pyasn1
  • ==< 0.6.2

Matching in nixpkgs

Upstream advisory: https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq
Upstream fix: https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970