[pkg-vuln] CVE-2026-59886 in pyasn1@0.6.3 #582

New Issue

kert · 2026-07-22T06:01:26Z

kert commented

2026-07-22 06:01:26 +00:00

Severity: HIGH
Package: pyasn1 @ 0.6.3
Fixed in: 0.6.4

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-59886

**Severity:** HIGH **Package:** `pyasn1` @ `0.6.3` **Fixed in:** `0.6.4` pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-59886

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-07-22 06:01:26 +00:00

kert added the quality ci labels 2026-07-22 06:01:26 +00:00

kert commented

2026-08-13 00:36:16 +00:00

pyasn1 0.6.3→0.6.4. CVE-2026-59886 (univ.Real big-exponent float conversion DoS): same exposure analysis as #581 — no untrusted ASN.1 decoding anywhere in the stack; transitive dep only. 0.6.4 caps the conversion cost.

Verification: bumped in commit 611a1d6 (pyproject floor raised for the direct dep; transitive pins via uv lock -P; pkg-manifest regenerated). Full test suite green with the bumped packages installed: 14,023 passed / 1 skipped (serial proof run 26m45s, then the commit hook's parallel run 13m58s). tests/api (the JWT/crypto surface) 335 passed post-bump.

pyasn1 0.6.3→0.6.4. CVE-2026-59886 (univ.Real big-exponent float conversion DoS): same exposure analysis as #581 — no untrusted ASN.1 decoding anywhere in the stack; transitive dep only. 0.6.4 caps the conversion cost. **Verification:** bumped in commit 611a1d6 (pyproject floor raised for the direct dep; transitive pins via `uv lock -P`; pkg-manifest regenerated). Full test suite green with the bumped packages installed: 14,023 passed / 1 skipped (serial proof run 26m45s, then the commit hook's parallel run 13m58s). `tests/api` (the JWT/crypto surface) 335 passed post-bump.

kert closed this issue

2026-08-13 00:36:16 +00:00

kert referenced this issue

2026-08-13 23:42:55 +00:00

[pkg-vuln] CVE-2026-59886 in pyasn1@0.6.3 #606

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#582