CVE-2026-59884

A flaw was found in pyasn1, a generic ASN.1 library for Python. The Basic Encoding Rules (BER) decoder, used by CER and DER codecs, processes long-form tags by accumulating continuation octets without an upper bound. A remote attacker can exploit this by providing a specially crafted input, leading to the construction of an arbitrarily large integer. This can cause the CPU cost to grow quadratically, resulting in a Denial of Service (DoS) for any application decoding untrusted BER, CER, or DER input.

A flaw was found in pyasn1's BER decoder. The decoder parses long-form tags by accumulating continuation octets without an upper bound, allowing crafted input to force construction of an arbitrarily large integer with quadratic CPU cost. On Python 3.11+, this can also trigger unhandled ValueError exceptions. Exploitation requires that an application passes untrusted BER, CER, or DER input directly to the pyasn1 decoder — pyasn1 is a library and does not independently accept network input. Many common uses of pyasn1 involve parsing trusted certificates or local configuration and are not exposed to this flaw. The realistic impact is a denial-of-service of the consuming Python process, with automatic recovery in typical service deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.