UBUNTU-CVE-2026-59885: High severity ubuntu/pyasn1 vulnerability

Q: Which applications are exposed to denial of service?

Applications using pyasn1 before 0.6.4 are exposed if they decode untrusted ASN.1 data containing OBJECT IDENTIFIER or RELATIVE-OID values. Applications that re-encode attacker-supplied values previously decoded by pyasn1 are also affected.

Q: What does an attacker need to exploit this issue?

An attacker needs to provide a crafted ASN.1 payload with an OID containing many arcs to an application that processes it. No privileges or user interaction are required.

Q: Are confidentiality or integrity affected?

The provided severity vector identifies availability impact only. The impact is excessive CPU consumption that can deny service for each affected decode or re-encode operation.

Q: What version fixes the issue?

Upgrade pyasn1 to version 0.6.4, which fixes the quadratic processing behavior in the affected BER, CER, and DER decoders and corresponding encoders.

Published Jul 14, 2026

Updated

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.

Affected Software

7 affected componentsFixes available

ubuntu/pyasn1*

ubuntu/pyasn1<0.4.8-1ubuntu0.3

0.4.8-1ubuntu0.3

ubuntu/pyasn1<0.4.8-4ubuntu0.3

0.4.8-4ubuntu0.3

ubuntu/pyasn1<0.6.3-1ubuntu0.1

0.6.3-1ubuntu0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/pyasn1 to a version that resolves this vulnerability.
Fixed in 0.4.8-1ubuntu0.3
Upgrade
Upgrade ubuntu/pyasn1 to a version that resolves this vulnerability.
Fixed in 0.4.8-4ubuntu0.3
Upgrade
Upgrade ubuntu/pyasn1 to a version that resolves this vulnerability.
Fixed in 0.6.3-1ubuntu0.1
Upgrade
Upgrade pyasn1 to a version that resolves this vulnerability.
Fixed in 0.6.4

Event History

Jul 14, 2026

CVE Published

via OSV·05:17 PM

Data Sourced

via OSV·05:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are exposed to denial of service?

Applications using pyasn1 before 0.6.4 are exposed if they decode untrusted ASN.1 data containing OBJECT IDENTIFIER or RELATIVE-OID values. Applications that re-encode attacker-supplied values previously decoded by pyasn1 are also affected.

What does an attacker need to exploit this issue?