CVE-2026-59885: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the num

highCVSS 7.5CVE-2026-59885

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.5
Published: 2026-07-14
Last updated: 2026-07-21
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59885

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-598850.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59885	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for pyasn1 is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

medium[UPDATE] [medium] Red Hat Enterprise Linux (pyasn1): Vulnerability allows Denial of Servicecert-bund · 2026-07-31
highGHSA-hm4w-wwcw-mr6r: pyasn1: Uncontrolled resource consumption when converting decoded REAL valuesghsa · 2026-07-21
highGHSA-8ppf-4f7h-5ppj: pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows deni…ghsa · 2026-07-21
highGHSA-m4p7-r5rc-7g4j: pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsghsa · 2026-07-21
highCVE-2026-59886: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its…nvd · 2026-07-14
highCVE-2026-59884: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CE…nvd · 2026-07-14