MGASA-2026-0380: python-pyasn1 Mageia

Published

Published 07-09-2026Last modified 07-09-2026

Vulnerability summary

MGASA-2026-0380 is a vulnerability in python-pyasn1 Mageia with no CVSS score yet.

Priority

Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

Not scored

010

No CVSS score recorded

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 3 · Downstream 0

CVE-2026-59884 CVE-2026-59885 CVE-2026-59886

Timeline

07-09-2026
PublishedVulnerability first disclosed.
07-09-2026
Last modifiedVulnerability information updated.

Description

Updated python-pyasn1 packages fix security vulnerabilities The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.