[pkg-vuln] CVE-2026-59886 in pyasn1@0.6.3 #606

New Issue

kert · 2026-08-13T06:01:26Z

kert commented

2026-08-13 06:01:26 +00:00

Severity: HIGH
Package: pyasn1 @ 0.6.3
Fixed in: 0.6.4

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-59886

**Severity:** HIGH **Package:** `pyasn1` @ `0.6.3` **Fixed in:** `0.6.4` pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-59886

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-08-13 06:01:26 +00:00

kert added the ci quality labels 2026-08-13 06:01:26 +00:00

kert commented

2026-08-13 23:42:55 +00:00

Duplicate of #582 — filed by the supply-chain scanner against the pre-fix dependency set. The bump landed in 611a1d6 (aiohttp 3.14.3, pyasn1 0.6.4, cryptography 50.0.0; verified installed) with per-CVE exploitability rationale on the original issue. The next scheduled scan runs against the fixed lockfile.

Duplicate of #582 — filed by the supply-chain scanner against the pre-fix dependency set. The bump landed in 611a1d6 (aiohttp 3.14.3, pyasn1 0.6.4, cryptography 50.0.0; verified installed) with per-CVE exploitability rationale on the original issue. The next scheduled scan runs against the fixed lockfile.

kert closed this issue

2026-08-13 23:42:55 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#606