CVE-2026-59885 pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
Attackers can cause denial of service in applications using pyasn1 by sending crafted ASN.1 data with many OID arcs, consuming excessive CPU.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59885?
CVE-2026-59885 is a high-severity denial of service vulnerability in pyasn1, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
Which versions are affected by CVE-2026-59885?
3 open source packages ship an affected version, including pyasn1. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyasn1 PyPI | All versions | 0.6.4 |
pyasn1 PyPI | All versions | 0.6.4 |
pyasn1 PyPI | All versions | 0.6.4 |
Products include Pyasn1 Pyasn1.
How do I fix CVE-2026-59885?
Upgrade pyasn1 to 0.6.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59885 being exploited?
There is no known exploitation of CVE-2026-59885 in the wild and no public exploit code.
Other vulnerabilities in pyasn1
Sources
Also known as AZL-92430, BELL-CVE-2026-59885, CLEANSTART-2026-EM41513, DEBIAN-CVE-2026-59885, ECHO-4cac-d3b9-56bc, GHSA-8ppf-4f7h-5ppj and 31 more.