CVE-2026-59884: pyasn1 ASN.1 Library DoS Vulnerability

CVE-2026-59884 Overview

CVE-2026-59884 is a denial-of-service vulnerability in pyasn1, a generic ASN.1 library for Python. The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size. A crafted input forces construction of an arbitrarily large integer with CPU cost growing quadratically. The flaw also triggers unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. The issue is fixed in version 0.6.4.

Critical Impact
Attackers can send crafted ASN.1 payloads to any service using pyasn1 prior to 0.6.4, exhausting CPU resources and crashing decoding processes without authentication.

Affected Products

pyasn1 versions prior to 0.6.4
Applications using the BER decoder for BER, CER, or DER input
Python 3.11+ environments where ValueError in tag formatting propagates unhandled

Discovery Timeline

2026-07-14 - CVE-2026-59884 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-59884

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw classified as [CWE-400] Uncontrolled Resource Consumption. ASN.1 BER encoding supports long-form tags where the tag identifier spans multiple continuation octets, each contributing 7 bits to the tag ID integer. The pyasn1 BER decoder accumulated these octets without enforcing an upper bound on the number of continuation bytes consumed.

An attacker supplies a stream of continuation octets that forces pyasn1 to build an arbitrarily large Python integer. The integer arithmetic scales quadratically with input length, consuming CPU disproportionately to payload size. On Python 3.11 and later, converting such an integer to a decimal string exceeds sys.get_int_max_str_digits(), raising an unhandled ValueError inside error formatting paths in pyasn1/type/tag.py.

Root Cause

The root cause is the absence of a bounds check in the long-form tag parser in pyasn1/codec/ber/decoder.py. The decoder loops over continuation octets until the high bit clears, with no cap on iterations. A related issue is that tag string rendering used decimal conversion, which fails on huge integers under Python 3.11+ integer-to-string limits.

Attack Vector

Exploitation requires only the ability to send an ASN.1-encoded blob to a service that decodes untrusted BER, CER, or DER input using pyasn1. This includes X.509 certificate parsers, SNMP agents, LDAP clients, Kerberos consumers, and PKCS#7/CMS handlers. No authentication or user interaction is required over the network.

python

# Patch in pyasn1/codec/ber/decoder.py — introduces MAX_TAG_OCTETS bound
 # Maximum number of continuation octets (high-bit set) allowed per OID arc.
 # 20 octets allows up to 140-bit integers, supporting UUID-based OIDs
 MAX_OID_ARC_CONTINUATION_OCTETS = 20
+
+# Maximum number of octets in a long-form tag ID (20 octets = up to
+# 140-bit tag IDs, matching the OID arc limit)
+MAX_TAG_OCTETS = 20
 MAX_NESTING_DEPTH = 100

 # Maximum number of bytes in a BER length field (8 bytes = up to 2^64-1)

Source: pyasn1 commit 628e36e

python

# Patch in pyasn1/type/tag.py — safe rendering of oversized tag IDs
 tagCategoryUntagged = 0x04


+def _tagIdToStr(tagId):
+    # Decimal rendering of a huge tag ID can exceed the interpreter's
+    # integer-to-string conversion limit (sys.get_int_max_str_digits(),
+    # Python 3.11+) and raise ValueError; hexadecimal is not limited
+    try:
+        return str(tagId)
+    except ValueError:
+        return hex(tagId)
+
+
 class Tag(object):
     """Create ASN.1 tag

Source: pyasn1 commit 628e36e

Detection Methods for CVE-2026-59884

Indicators of Compromise

Python worker processes stalling at high CPU utilization while decoding ASN.1 input from network sources
Unhandled ValueError exceptions originating from pyasn1/type/tag.py in application logs on Python 3.11+
Repeated crashes or restarts of services handling X.509, SNMP, LDAP, or Kerberos traffic from a single source

Detection Strategies

Inventory Python environments and identify processes importing pyasn1 at a version below 0.6.4 using pip list or SBOM tooling
Instrument decoder entry points with input size and decode-duration metrics to flag anomalous processing times
Correlate application crash telemetry with inbound ASN.1 payloads that contain long-form tag sequences exceeding 20 continuation octets

Monitoring Recommendations

Alert on sustained CPU spikes tied to processes decoding certificates, SNMP PDUs, or LDAP messages
Track exception rates for ValueError in Python services and route stack traces referencing pyasn1 to security review
Ingest package inventory and runtime telemetry into a centralized data lake to correlate vulnerable dependencies with active exploitation signals

How to Mitigate CVE-2026-59884

Immediate Actions Required

Upgrade pyasn1 to version 0.6.4 or later across all Python environments
Rebuild and redeploy container images and virtual environments that pin an older pyasn1 release
Audit transitive dependencies with pip show pyasn1 or SBOM tooling, since libraries such as pyasn1-modules, python-ldap, and pysnmp pull it in

Patch Information

The fix is included in pyasn1 version 0.6.4. See the GitHub Security Advisory GHSA-m4p7-r5rc-7g4j, the GitHub Release v0.6.4, and the remediation commit 628e36e. The patch caps long-form tag parsing at MAX_TAG_OCTETS = 20 and renders oversized tag IDs in hexadecimal to avoid ValueError under Python 3.11+.

Workarounds

Restrict untrusted ASN.1 input at the network perimeter until patching completes
Enforce maximum request size limits on endpoints that accept certificates, SNMP messages, or LDAP payloads
Wrap pyasn1 decoder calls in a timeout or subprocess sandbox to bound CPU consumption per request

bash

# Upgrade pyasn1 to the fixed release
pip install --upgrade 'pyasn1>=0.6.4'

# Verify the installed version
python -c "import pyasn1; print(pyasn1.__version__)"

# Audit dependent packages that transitively load pyasn1
pip list | grep -Ei 'pyasn1|ldap|snmp|krb'