CVE-2026-59886: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponent

highCVSS 7.5CVE-2026-59886

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.5
Published: 2026-07-14
Last updated: 2026-07-21
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59886

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-598860.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59886	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for pyasn1 is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

medium[UPDATE] [medium] Red Hat Enterprise Linux (pyasn1): Vulnerability allows Denial of Servicecert-bund · 2026-07-31
highGHSA-hm4w-wwcw-mr6r: pyasn1: Uncontrolled resource consumption when converting decoded REAL valuesghsa · 2026-07-21
highGHSA-8ppf-4f7h-5ppj: pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows deni…ghsa · 2026-07-21
highGHSA-m4p7-r5rc-7g4j: pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsghsa · 2026-07-21
highCVE-2026-59885: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders p…nvd · 2026-07-14
highCVE-2026-59884: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CE…nvd · 2026-07-14