SB20261109217 - Multiple vulnerabilities in py-asn1

Description

This security bulletin contains information about 2 vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2026-59886)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to cause denial of service by exhausting CPU and memory in applications using pyasn1.

The vulnerability exists due to exact big-integer exponentiation during float conversion of ASN.1 REAL values with large exponents, triggered by operations on decoded objects rather than decoding alone. An unauthenticated remote attacker can supply a compact encoded REAL value that hangs the process when the application prints or compares it.

2) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-59885)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to cause denial of service through excessive CPU consumption in applications that process untrusted ASN.1 data using pyasn1.

The vulnerability exists due to quadratic processing of OBJECT IDENTIFIER and RELATIVE-OID values with many arcs in the BER, CER, and DER decoders and encoders. An unauthenticated remote attacker can submit a crafted payload of tens of kilobytes that consumes seconds of CPU when decoded or subsequently re-encoded.

Remediation

Install update from vendor's website.

References

• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r
• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj