[pkg-vuln] CVE-2026-59885 in pyasn1@0.6.3 #581

New Issue

kert · 2026-07-22T06:01:26Z

kert commented

2026-07-22 06:01:26 +00:00

Severity: HIGH
Package: pyasn1 @ 0.6.3
Fixed in: 0.6.4

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-59885

**Severity:** HIGH **Package:** `pyasn1` @ `0.6.3` **Fixed in:** `0.6.4` pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-59885

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-07-22 06:01:26 +00:00

kert added the ci quality labels 2026-07-22 06:01:26 +00:00

kert commented

2026-08-13 00:36:16 +00:00

pyasn1 0.6.3→0.6.4. CVE-2026-59885 (quadratic OID-arc decode DoS): this repo never decodes untrusted ASN.1 — pyasn1 is transitive via google-auth/rsa TLS-auth flows against trusted Google/Azure endpoints, so the vulnerable decode path was not attacker-reachable here. Fixed version eliminates the quadratic behavior regardless.

Verification: bumped in commit 611a1d6 (pyproject floor raised for the direct dep; transitive pins via uv lock -P; pkg-manifest regenerated). Full test suite green with the bumped packages installed: 14,023 passed / 1 skipped (serial proof run 26m45s, then the commit hook's parallel run 13m58s). tests/api (the JWT/crypto surface) 335 passed post-bump.

pyasn1 0.6.3→0.6.4. CVE-2026-59885 (quadratic OID-arc decode DoS): this repo never decodes untrusted ASN.1 — pyasn1 is transitive via google-auth/rsa TLS-auth flows against trusted Google/Azure endpoints, so the vulnerable decode path was not attacker-reachable here. Fixed version eliminates the quadratic behavior regardless. **Verification:** bumped in commit 611a1d6 (pyproject floor raised for the direct dep; transitive pins via `uv lock -P`; pkg-manifest regenerated). Full test suite green with the bumped packages installed: 14,023 passed / 1 skipped (serial proof run 26m45s, then the commit hook's parallel run 13m58s). `tests/api` (the JWT/crypto surface) 335 passed post-bump.

kert closed this issue

2026-08-13 00:36:16 +00:00

kert referenced this issue

2026-08-13 00:36:16 +00:00

[pkg-vuln] CVE-2026-59886 in pyasn1@0.6.3 #582

kert referenced this issue

2026-08-13 00:36:16 +00:00

[pkg-vuln] CVE-2026-59884 in pyasn1@0.6.3 #583

kert referenced this issue

2026-08-13 23:42:54 +00:00

[pkg-vuln] CVE-2026-59885 in pyasn1@0.6.3 #605

Sign in to join this conversation.