Back to overview

CVE-2026-59886

HIGH
7.5
CVSS 3.1
Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.

Metadata

CVE ID
CVE-2026-59886
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-07-07 16:40 UTC
Published
2026-07-14 16:38 UTC
Last updated
2026-07-14 16:38 UTC
Primary CWE
CWE-400
CWE-400: Uncontrolled Resource Consumption
Vendor / Product
pyasn1 / pyasn1
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products (1)
VendorProductPlatformVersions
pyasn1 pyasn1 — < 0.6.4
Weakness (CWE)
CWESourceDescription
CWE-400 cna CWE-400: Uncontrolled Resource Consumption
CWE-770 cna CWE-770: Allocation of Resources Without Limits or Throttling
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References (3)
Back to overview