UBUNTU-CVE-2026-59884: High severity ubuntu/pyasn1 vulnerability
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/pyasn1to a version that resolves this vulnerability.Fixed in 0.4.8-1ubuntu0.3 - Upgrade
Upgrade
ubuntu/pyasn1to a version that resolves this vulnerability.Fixed in 0.4.8-4ubuntu0.3 - Upgrade
Upgrade
ubuntu/pyasn1to a version that resolves this vulnerability.Fixed in 0.6.3-1ubuntu0.1 - Upgrade
Upgrade
pyasn1to a version that resolves this vulnerability.Fixed in 0.6.4
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No. The vulnerability is rated network-accessible with low attack complexity, no privileges required, and no user interaction required.
How can I determine whether an installation is affected?
Installations using pyasn1 versions earlier than 0.6.4 are affected if their application decodes untrusted BER, CER, or DER input.
What is the practical impact of a malicious payload?
A crafted long-form tag can cause quadratic CPU consumption while constructing an arbitrarily large tag ID integer, resulting in denial of service. On Python 3.11 and later, related error-formatting paths can also raise unhandled ValueError exceptions.
What should be done to remediate the issue?
Upgrade pyasn1 to version 0.6.4, which includes the fix.