UBUNTU-CVE-2026-59886: High severity ubuntu/pyasn1 vulnerability
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/pyasn1to a version that resolves this vulnerability.Fixed in 0.4.8-1ubuntu0.3 - Upgrade
Upgrade
ubuntu/pyasn1to a version that resolves this vulnerability.Fixed in 0.4.8-4ubuntu0.3 - Upgrade
Upgrade
ubuntu/pyasn1to a version that resolves this vulnerability.Fixed in 0.6.3-1ubuntu0.1 - Upgrade
Upgrade
pyasn1to a version that resolves this vulnerability.Fixed in 0.6.4
Event History
Frequently Asked Questions
Which applications are exposed to denial of service?
Applications using pyasn1 before version 0.6.4 are exposed if they decode untrusted BER, CER, or DER ASN.1 data and subsequently convert, print, log, compare, perform arithmetic on, or otherwise coerce decoded REAL values.
What does an attacker need to do to trigger the issue?
An attacker needs to supply an encoded ASN.1 REAL value with a very large exponent. The application must decode it and invoke a path such as prettyPrint(), str(), comparison, arithmetic, int(), or float() on the resulting value.
How can I determine whether my deployment is affected?
Check whether the installed pyasn1 version is earlier than 0.6.4. Also identify code paths that accept untrusted ASN.1 input and print, log, compare, or numerically convert decoded REAL objects.
What is the available remediation?
Upgrade pyasn1 to version 0.6.4, which fixes the issue.