[pkg-vuln] CVE-2026-59885 in pyasn1@0.6.3 #605

New Issue

kert · 2026-08-13T06:01:26Z

kert commented

2026-08-13 06:01:26 +00:00

Severity: HIGH
Package: pyasn1 @ 0.6.3
Fixed in: 0.6.4

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-59885

**Severity:** HIGH **Package:** `pyasn1` @ `0.6.3` **Fixed in:** `0.6.4` pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-59885

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-08-13 06:01:26 +00:00

kert added the quality ci labels 2026-08-13 06:01:26 +00:00

kert commented

2026-08-13 23:42:54 +00:00

Duplicate of #581 — filed by the supply-chain scanner against the pre-fix dependency set. The bump landed in 611a1d6 (aiohttp 3.14.3, pyasn1 0.6.4, cryptography 50.0.0; verified installed) with per-CVE exploitability rationale on the original issue. The next scheduled scan runs against the fixed lockfile.

Duplicate of #581 — filed by the supply-chain scanner against the pre-fix dependency set. The bump landed in 611a1d6 (aiohttp 3.14.3, pyasn1 0.6.4, cryptography 50.0.0; verified installed) with per-CVE exploitability rationale on the original issue. The next scheduled scan runs against the fixed lockfile.

kert closed this issue

2026-08-13 23:42:55 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#605