CVE-2026-59884 Details

A denial-of-service vulnerability has been identified in the pyasn1 library, specifically in versions prior to 0.6.4. The issue arises in the BER decoder, which is also used by the CER and DER codecs. The vulnerability allows a crafted input to exploit unbounded long-form tag IDs, causing the decoder to generate excessively large integers. This exploitation leads to quadratic CPU consumption, with approximately 1 MB of input causing over a minute of CPU time. Additionally, in Python 3.11 and later, the oversized tag IDs can trigger unhandled ValueError exceptions during error message formatting, bypassing standard error handling protocols. Any application that decodes untrusted BER, CER, or DER input is susceptible to this vulnerability.

Users can upgrade to pyasn1 version 0.6.4, which limits long-form tag IDs to 20 octets and addresses the associated denial-of-service vulnerability. Instructions for downloading this version are available on the pyasn1 GitHub releases page.