Resource exhaustion in py-asn1 - CVE-2026-59886

Vulnerability identifier: #VU163164

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-59886

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an unauthenticated remote attacker to cause denial of service by exhausting CPU and memory in applications using pyasn1.

The vulnerability exists due to exact big-integer exponentiation during float conversion of ASN.1 REAL values with large exponents, triggered by operations on decoded objects rather than decoding alone. An unauthenticated remote attacker can supply a compact encoded REAL value that hangs the process when the application prints or compares it.

py-asn1
Anolis OS
python-pyasn1-doc
python3-pyasn1
python3-pyasn1-modules
resource-agents
resource-agents-aliyun
resource-agents-gcp
resource-agents-paf

Install security update from vendor's website.

py-asn1 - update to 0.6.4
python-pyasn1-doc - update to 0.3.7-6.0.1
python3-pyasn1 - update to 0.3.7-6.0.1
python3-pyasn1-modules - update to 0.3.7-6.0.1
resource-agents - update to 4.9.0-54
resource-agents-aliyun - update to 4.9.0-54
resource-agents-gcp - update to 4.9.0-54
resource-agents-paf - update to 4.9.0-54

• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r

• Multiple vulnerabilities in py-asn1
• Anolis OS update for resource-agents
• Anolis OS update for python-pyasn1