PT-2026-58286 · Pypi · Pyasn1

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-59884

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions pyasn1 versions prior to 0.6.4

Description The BER decoder used by CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size. A crafted input can force the construction of an arbitrarily large integer, resulting in CPU cost that grows quadratically and triggering unhandled ValueError exceptions in Python 3.11+ error formatting paths. This affects any application decoding untrusted BER, CER, or DER input.

Recommendations Update to version 0.6.4.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-59884

GHSA-M4P7-R5RC-7G4J

Affected Products

Pyasn1

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59884.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-59884 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59884 · Security Note
• https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 · Note
• https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5 · Note
• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j · Note