CVE-2026-59885: pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
Vulnerability summary
CVE-2026-59885 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in pyasn1. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49.5% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 12 · Related 9Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 14-07-2026Last modifiedVulnerability information updated.
Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.62% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard65 products
- airflow-2All versions (No fix recorded)
- airflow-3< 3.3.0-r4
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- apache-beam-python-3.12-sdk< 2.75.0-r1
- authentik-2026.2< 2026.2.6-r11
Wolfi25 products
- airflow-3< 3.3.0-r4
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- datadog-agent-7.72-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.73-core-integrations< 7.73.3-r23
- datadog-agent-7.74-core-integrations< 7.74.1-r24
Debian1 product
- pyasn1< 0.4.8-3+deb12u3 | < 0.6.1-1+deb13u3 | < 0.6.4-1
Pyasn11 product
- pyasn1< 0.6.4
PyPI1 product
- pyasn1< 0.6.4
Ubuntu1 product
- pyasn1All versions (No fix recorded) | < 0.4.8-1ubuntu0.3 | < 0.4.8-4ubuntu0.3 | < 0.6.3-1ubuntu0.1
6 vendors · 94 products
References
10 links- github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppjX Refsource CONFIRMWEBAdvisoryREPORTThird Party Advisory
- github.com/pyasn1/pyasn1PACKAGE
