pyasn1 parsing bugs can exhaust CPU when decoding ASN.1
Original title: USN-9011-1: pyasn1 vulnerabilities
CVE-2026-59884 affects only Ubuntu 14.04, 16.04, 18.04, and 20.04 LTS.
Ubuntu said pyasn1 did not bound long-form tag identifiers when parsing BER, CER, or DER data, so decoding untrusted ASN.1 could consume excessive CPU and cause a denial of service. That issue, CVE-2026-59884, affects only four older Ubuntu LTS releases. A second flaw processes OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, also risking CPU exhaustion. The snippet ends before any fix.
Unconfirmed: The snippet ends before a CVE id or fixed version for the OID issue.
- CVE-2026-59884 involves unbounded long-form tag identifiers in BER, CER, or DER.
- The OID flaw grows with the number of arcs and can exhaust CPU.
- No fixed package version appears in the truncated notice.
Impact: denial of service through excessive CPU use
| Product | Affected |
|---|---|
| Ubuntu pyasn1 | Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, and 20.04 LTS for CVE-2026-59884 |
- 1.Install Ubuntu's pyasn1 security updates for affected releases when available.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59884 | pyasn1 is a generic ASN.1 library for Python | 7.5 | <1% |
From the original article
It was discovered that pyasn1 did not properly bound the size of long-form tag identifiers when parsing BER, CER, or DER encoded data. An attacker could possibly use this issue to cause applications decoding untrusted ASN. 1 data to consume excessive CPU resources, resulting in a denial of service.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.