CVE-2026-59885: pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
Impact The BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload (tens of kilobytes) containing an OID with many arcs consumes seconds of CPU per decode() call, allowing denial of service in any application that decodes untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos, etc.). The corresponding encoders have the same quadratic behavior, reachable when an application re-encodes previously decoded attacker-supplied values.
The arc-size limit introduced for CVE-2026-23490 bounds the byte length of an individual arc but not the number of arcs, so it does not mitigate this issue.
Affected components ObjectIdentifierPayloadDecoder and RelativeOIDPayloadDecoder in pyasn1/codec/ber/decoder.py; ObjectIdentifierEncoder and RelativeOIDEncoder in pyasn1/codec/ber/encoder.py. The CER and DER codecs inherit these and are equally affected.
Patches Fixed in pyasn1 0.6.4: arc accumulation in both decoders and encoders now runs in linear time.
Workarounds Limit the size of untrusted ASN.1 input before decoding.
Other sources
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
— MITRE
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pyasn1to a version that resolves this vulnerability.Fixed in 0.6.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.4.8-3 - Upgrade
Upgrade
debian/pyasn1to a version that resolves this vulnerability.Fixed in 0.6.4-1 - Upgrade
Upgrade
pyasn1to a version that resolves this vulnerability.Fixed in 0.6.4 - Configuration
Before calling the pyasn1 BER/CER/DER decoders that process OBJECT IDENTIFIER and RELATIVE-OID (e.g., in pyasn1/codec/ber/decoder.py), limit the size of untrusted ASN.1 input so large crafted payloads (tens of kilobytes with an OID containing many arcs) are rejected prior to decode().
Application decoding untrusted ASN.1 (e.g., certificates, LDAP, SNMP, Kerberos) using pyasn1/codec/ber/decoder.py limit_size_of_untrusted_asn1_input_before_decoding = enabled (set an upper bound) - Configuration
If the application re-encodes previously decoded attacker-supplied OBJECT IDENTIFIER/RELATIVE-OID values using pyasn1/codec/ber/encoder.py, enforce input-size limits before decoding and avoid re-encoding untrusted values unless necessary, because the corresponding encoders can exhibit quadratic behavior as well.
Application re-encoding previously decoded attacker-supplied OID values using pyasn1/codec/ber/encoder.py avoid_re-encoding_untrusted_oid_values_without_limits = enabled (apply size/arc limits or skip re-encoding)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59885?
The severity of CVE-2026-59885 is classified as high with a score of 7.5.
What does CVE-2026-59885 affect?
CVE-2026-59885 affects the pyasn1 library for Python, specifically its handling of OBJECT IDENTIFIER and RELATIVE-OID processing.
How do I fix CVE-2026-59885?
To fix CVE-2026-59885, upgrade the pyasn1 library to version 0.6.4 or later.
What type of vulnerability is CVE-2026-59885?
CVE-2026-59885 is a denial of service vulnerability caused by quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing.
What attacks can be performed using CVE-2026-59885?
An attacker can exploit CVE-2026-59885 to create crafted payloads that excessively consume CPU resources, leading to potential denial of service.