VDB
RHSA-2026%3A14020
RHSA-2026%3A14020
PUBLISHED
CVSS 7.099999904632568 HIGH
Record from redhat · Published May 6, 2026
A flaw was found in pyasn1, a generic ASN.1 library for Python. A remote attacker could exploit this vulnerability by sending a specially crafted RELATIVE-OID with excessive continuation octets. This input validation vulnerability leads to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
Risk scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64 as a component of Service Telemetry Framework 1.5 | * |
| Red Hat | registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64 as a component of Service Telemetry Framework 1.5 | * |
| Red Hat | registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64 as a component of Service Telemetry Framework 1.5 | * |
| Red Hat | registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64 as a component of Service Telemetry Framework 1.5 | * |
| Red Hat | registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64 as a component of Red Hat OpenStack 1.5 | registry.redhat.io/stf/sg-core-rhel9@sha256:73bbc51fe49e965907f35d7176759235bff876032e40616366093ead21372c71_amd64, * |
| Red Hat | registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64 as a component of Red Hat OpenStack 1.5 | registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64, * |
| Red Hat | registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64 as a component of Red Hat OpenStack 1.5 | registry.redhat.io/stf/service-telemetry-rhel9-operator@sha256:6a9a6329f33c56bd44d760fa0d80a6c34b6a5d5942cf5a32b46e49899f546483_amd64, * |
| Red Hat | registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64 as a component of Service Telemetry Framework 1.5 | * |
| Red Hat | registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64 as a component of Red Hat OpenStack 1.5 | *, registry.redhat.io/stf/prometheus-webhook-snmp-rhel9@sha256:f491bfd1f9829050d5ca68786aa1bdf74f1ce6e030b7c1112cc68b3858d83b88_amd64 |
| Red Hat | registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64 as a component of Service Telemetry Framework 1.5 | * |
| Red Hat | registry.redhat.io/stf/smart-gateway-operator-bundle@sha256:fdff297b0f11bac06d6e4d82e1dc8724ab42f0be6a0fdcbc5cd6c80c7bc7bffe_amd64 as a component of Service Telemetry Framework 1.5 | * |
| Red Hat | registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64 as a component of Red Hat OpenStack 1.5 | *, registry.redhat.io/stf/smart-gateway-rhel9-operator@sha256:247fd48abbb8862bff7aa76d742a8edcbb4bc0cef35b5624c458a502cd709a8d_amd64 |
| Red Hat | Service Telemetry Framework | |
| Red Hat | registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64 as a component of Red Hat OpenStack 1.5 | registry.redhat.io/stf/sg-bridge-rhel9@sha256:58085c6b3136a28e803409d7203486650b276f2c7aaf124936b0166738a11f8b_amd64, * |
| Red Hat | registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64 as a component of Red Hat OpenStack 1.5 | registry.redhat.io/stf/service-telemetry-operator-bundle@sha256:1abefb6eb3d624f2b9b827f31ecae69a2c84e50a2fe91be81d01d6c2b4ec766b_amd64, * |
| Python Packaging Authority | wheel |
Timeline
- May 6, 2026 CVE Published
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2026%3A14020
vulnetix vdb fixes RHSA-2026%3A14020Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%253A14020/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/errata/RHSA-2026:14020 advisory
- https://access.redhat.com/security/cve/CVE-2026-23490 advisory
- https://access.redhat.com/security/cve/CVE-2026-24049 advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 advisory
- https://access.redhat.com/security/cve/CVE-2026-30922 advisory
- https://access.redhat.com/security/cve/CVE-2026-32280 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://catalog.redhat.com/software/containers/search advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14020.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2430472 issue
- https://www.cve.org/CVERecord?id=CVE-2026-23490 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-23490 advisory
- https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970 advisory
- https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2 advisory
- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2431959 issue
- https://www.cve.org/CVERecord?id=CVE-2026-24049 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-24049 advisory
- https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef advisory
- https://github.com/pypa/wheel/releases/tag/0.46.2 advisory
…and 20 more