CVE-2026-59885

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9	Patch
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4	Release Notes
https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:*

History

21 Jul 2026, 14:38

Type	Values Removed	Values Added
CPE		cpe:2.3:a:pyasn1:pyasn1::::::python::*
References	~~() https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9 -~~	() https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9 - Patch
References	~~() https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 -~~	() https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 - Release Notes
References	~~() https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj -~~	() https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj - Third Party Advisory
First Time		Pyasn1 Pyasn1 pyasn1

14 Jul 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-14 17:17

Updated : 2026-07-21 14:38

NVD link : CVE-2026-59885

Mitre link : CVE-2026-59885

CVE.ORG link : CVE-2026-59885

JSON object : View

Products Affected

pyasn1

pyasn1

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-407

Inefficient Algorithmic Complexity

{"id": "CVE-2026-59885", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59885", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T17:32:32.986793Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pyasn1", "product": "pyasn1", "versions": [{"status": "affected", "version": "< 0.6.4"}]}]}], "published": "2026-07-14T17:17:14.880", "references": [{"url": "https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4."}], "lastModified": "2026-07-21T14:38:21.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "9AFAC251-9C55-4538-A9B2-28C2923FBB01", "versionEndExcluding": "0.6.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}