pyasn1 parsing bugs can exhaust CPU when decoding ASN.1
CVE-2026-59884 affects only Ubuntu 14.04, 16.04, 18.04, and 20.04 LTS.
34
CVE-2026-59884
- CVSS 3.1
- 7.5 high
- EPSS
- <1%p28
- Published
- ·
- Modified
Description · NVD
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.