CVE-2026-59886 pyasn1: Uncontrolled resource consumption when converting decoded REAL values
Attackers can cause denial of service in applications using pyasn1 by sending crafted ASN.1 REAL values that trigger excessive resource consumption during conversion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59886?
CVE-2026-59886 is a high-severity denial of service vulnerability in pyasn1, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.
Which versions are affected by CVE-2026-59886?
3 open source packages ship an affected version, including pyasn1. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyasn1 PyPI | All versions | 0.6.4 |
pyasn1 PyPI | All versions | 0.6.4 |
pyasn1 PyPI | All versions | 0.6.4 |
Linux distribution packages (37)
python3-pyasn1 AlmaLinux:10 | All versions | 0.6.2-1.el10_2.1 |
python3-pyasn1-modules AlmaLinux:10 | All versions | 0.6.2-1.el10_2.1 |
fence-agents-aliyun AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-all AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-amt-ws AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-apc AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-apc-snmp AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-aws AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-azure-arm AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-bladecenter AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-brocade AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-cisco-mds AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-cisco-ucs AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-common AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-compute AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-drac5 AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-eaton-snmp AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-emerson AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-eps AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-gce AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-heuristics-ping AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-hpblade AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-ibm-powervs AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-ibm-vpc AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-ibmblade AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-ifmib AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-ilo-moonshot AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-ilo-mp AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-ilo-ssh AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-ilo2 AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-intelmodular AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-ipdu AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-ipmilan AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-kdump AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-kubevirt AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-lpar AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
fence-agents-mpath AlmaLinux:8 | All versions | 4.2.1-129.el8_10.29 |
Products include Pyasn1 Pyasn1.
How do I fix CVE-2026-59886?
Upgrade pyasn1 to 0.6.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59886 being exploited?
There is no known exploitation of CVE-2026-59886 in the wild and no public exploit code.
Other vulnerabilities in pyasn1
Sources
Also known as ALSA-2026:53363, ALSA-2026:53364, ALSA-2026:53365, ALSA-2026:59241, ALSA-2026:59242, ALSA-2026:59243 and 68 more.