Inefficient Algorithmic Complexity in py-asn1 - CVE-2026-59885
Published: November 9, 2026
Vulnerability identifier: #VU163165
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59885
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause denial of service through excessive CPU consumption in applications that process untrusted ASN.1 data using pyasn1.
The vulnerability exists due to quadratic processing of OBJECT IDENTIFIER and RELATIVE-OID values with many arcs in the BER, CER, and DER decoders and encoders. An unauthenticated remote attacker can submit a crafted payload of tens of kilobytes that consumes seconds of CPU when decoded or subsequently re-encoded.
Affected software
py-asn1
How to mitigate CVE-2026-59885
Install security update from vendor's website.
py-asn1 - update to 0.6.4