CVE-2026-59884 pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

What is CVE-2026-59884?

CVE-2026-59884 is a high-severity denial of service vulnerability in pyasn1, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

Weakness: CWE-400

Which versions are affected by CVE-2026-59884?

3 open source packages ship an affected version, including pyasn1. It affects 1 product.

Products include Pyasn1 Pyasn1.

How do I fix CVE-2026-59884?

Upgrade pyasn1 to 0.6.4 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-59884 being exploited?

There is no known exploitation of CVE-2026-59884 in the wild and no public exploit code.

Other vulnerabilities in pyasn1

• CVE-2026-59885 pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service High 7.5
• CVE-2026-59886 pyasn1: Uncontrolled resource consumption when converting decoded REAL values High 7.5
• CVE-2026-30922 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-92433, BELL-CVE-2026-59884, CLEANSTART-2026-RT57573, DEBIAN-CVE-2026-59884, ECHO-26aa-f245-5297, GHSA-m4p7-r5rc-7g4j and 31 more.