CVE-2026-59884
Impact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
- pyasn1.codec.ber.decoder — decode() and StreamingDecoder
- pyasn1.codec.cer.decoder and pyasn1.codec.der.decoder, which inherit
the same tag parsing
- pyasn1.type.tag — Tag/TagSet reprs could raise ValueError when
rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
CSIRTS triage
- What
- Unbounded long-form tag IDs in the BER/CER/DER decoder can lead to denial of service.
- Who is affected
- Users of pyasn1 are affected by this vulnerability.
- Urgency
- This is a high urgency issue due to its high severity and potential for exploitation.
- Action
- Upgrade to the latest version of pyasn1.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-59884
Get an email if CVE-2026-59884 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
Advisory coverage (3)
- highGHSA-m4p7-r5rc-7g4j: pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsghsa · 2026-07-21
- highCVE-2026-59884: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CE…nvd · 2026-07-14
- highCVE-2026-59884: pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsmsrc · 2026-07-14
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-59884)