CVE-2026-59885 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4… | CVSS 7.5 HIGH

Description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.

Metadata

CVE ID: CVE-2026-59885
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-07-07 16:40 UTC
Published: 2026-07-14 16:40 UTC
Last updated: 2026-07-14 17:32 UTC
Primary CWE: CWE-400
CWE-400: Uncontrolled Resource Consumption
Vendor / Product: pyasn1 / pyasn1
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
pyasn1	pyasn1	—	< 0.6.4

Weakness (CWE)

CWE	Source	Description
CWE-400	cna	CWE-400: Uncontrolled Resource Consumption
CWE-407	cna	CWE-407: Inefficient Algorithmic Complexity

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (3)

https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj
https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9 https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4