Certificate validation feels like a defensive boundary. A service receives an X.509 certificate, checks its signature and fields, and accepts or rejects the identity. CVE-2026-23490 puts a sensitive parser behind that boundary. A malformed ASN.1 identifier can consume memory inside pyasn1 before the application gets to a clean rejection.
The weakness is present in pyasn1 0.6.1 and fixed in 0.6.2. IBM Maximo Application Suite 8.10, 8.11, 9.0, and 9.1 used the vulnerable package. Fixed Maximo releases are 8.10.35, 8.11.32, 9.0.21, and 9.1.10.
The parser is part of the attack surface
ASN.1 is a notation for describing structured data. BER is one of the encodings used to carry that data. RELATIVE-OID values identify objects in a tree and use continuation octets to represent arcs. The 0.6.1 decoder appended each new arc with reloid += ((subId << 7) + nextSubId,) without a reasonable cap on the number of continuation octets or the object size.
An attacker can therefore craft input that drives repeated accumulation. The application may have intended to validate the certificate and reject it later, but the decoder has to process the structure first. That is why validation services should be treated as parsing targets, not just policy checks.
Where Maximo teams should look
IBM's bulletin connects the library to Maximo, but it does not establish that every component parses certificates from the internet. Teams need to find the concrete path. Look for services that import certificates, validate client identities, process enrollment material, inspect signed assertions, or accept BER or DER data from external users.
A useful test is to ask who controls the bytes and where the decode happens. If a trusted administrator uploads a certificate, the risk may still exist but the exposure is different from an anonymous enrollment endpoint. If an internet-facing gateway forwards arbitrary certificates to a Python service, the vulnerable parser may sit directly behind the public edge.
The GitHub advisory also names LDAP servers, TLS endpoints, and OCSP responders as examples in the affected class. These are prompts for architecture review, not findings about a specific Maximo installation. A service can be TLS-enabled without exposing a certificate-validation path to untrusted data. Reachability checks need to follow the code and configuration.
Availability impact can look like a normal outage
Memory exhaustion may not produce an obvious security alert. A worker can slow down, stop responding, or be killed by a container limit. The orchestrator may restart it. If the same malformed input is retried or queued, the cycle can repeat. Users may report timeouts, login failures, or missing background jobs rather than a security event.
CVE-2026-23490 has a CVSS 3.1 score of 7.5 with a network vector and high availability impact. The scored vector requires no privileges or user interaction. The attacker does not need to execute code. They only need to reach a vulnerable decoder with data that drives resource consumption.
Controls before and after patching
The primary fix is to remove pyasn1 0.6.1 by applying the fixed Maximo release for the installed branch. IBM says no workaround is available. In the meantime, teams can reduce who can submit certificates or ASN.1 input to the affected component, place stricter request-size and rate limits in front of exposed endpoints, and watch memory and restart behavior during certificate-heavy workflows.
Those controls need careful testing. A generic request-size limit may not prevent the issue if the parser amplifies a relatively small input. A rate limit may delay abuse without stopping a single expensive request. Use them as containment measures while the supported fix is deployed.
After patching, verify the running image or package inventory. Then test the certificate workflows that matter: client authentication, trust-store import, enrollment, and any integration that accepts encoded identity data. A successful application health check does not prove that the vulnerable parser has been replaced.
The inventory question
ZoomEye Search for title="IBM Maximo" returned 673 matches, while the CVE Filter returned 0. The larger successful count provides exposure context, but it does not identify certificate-processing endpoints or confirm vulnerable versions. Security teams should use the result to find public Maximo surfaces, then validate reachability and version state inside the deployment.
The larger lesson is that certificate validation code deserves the same inventory discipline as a web endpoint. The parser, its library version, and the trust boundary around it are all part of the exposure decision.