CVE-2026-59885: pyasn1 Python Library DoS Vulnerability

CVE-2026-59885 Overview

CVE-2026-59885 is a denial-of-service vulnerability in pyasn1, a widely used generic ASN.1 library for Python. Versions prior to 0.6.4 decode OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call. The corresponding encoders exhibit the same quadratic behavior when applications re-encode attacker-supplied values. Applications that decode untrusted ASN.1 data — including X.509 certificate parsers, SNMP handlers, and LDAP clients — can be denied service by a small malicious input.

Critical Impact
Remote unauthenticated attackers can trigger CPU exhaustion in any Python service that decodes untrusted ASN.1 data using pyasn1 versions before 0.6.4, resulting in denial of service.

Affected Products

pyasn1 Python library versions prior to 0.6.4
Applications performing BER, CER, or DER decoding of untrusted ASN.1 data
Downstream libraries and services depending on vulnerable pyasn1 releases

Discovery Timeline

2026-07-14 - CVE-2026-59885 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-59885

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw [CWE-400] in the BER, CER, and DER codec paths of pyasn1. When decoding an OBJECT IDENTIFIER or RELATIVE-OID, the implementation accumulates arcs into an immutable tuple using the += operator. Each concatenation allocates a new tuple and copies all previously collected arcs, producing O(n²) time and memory behavior across n arcs. The encoder mirrors the same pattern when serializing arcs into an octet sequence. A crafted OID containing tens of thousands of arcs fits in a few kilobytes yet stalls a single CPU core for seconds or longer per decode() call.

Root Cause

The root cause is the use of tuple concatenation inside an unbounded loop in pyasn1/codec/ber/decoder.py and pyasn1/codec/ber/encoder.py. Python tuples are immutable, so appending via oid += (subId,) reconstructs the entire sequence on every iteration. There is no upper bound on the number of arcs an attacker may supply, so processing time grows quadratically with input size.

Attack Vector

The attack vector is network-facing and requires no authentication or user interaction. Any service that accepts and decodes ASN.1 structures from untrusted sources is exposed. A single small payload sent repeatedly can saturate worker processes and deny service to legitimate clients.

python

# Patched code from pyasn1/codec/ber/decoder.py
# Source: https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9

        if not chunk:
            raise error.PyAsn1Error('Empty substrate')

-        oid = ()
+        oid = []
         index = 0
         substrateLen = len(chunk)
         while index < substrateLen:
             subId = chunk[index]
             index += 1
             if subId < 128:
-                oid += (subId,)
+                oid.append(subId)
             elif subId > 128:
                 # Construct subid from a number of octets
                 nextSubId = subId

The fix replaces the immutable tuple with a mutable list and uses append(), reducing accumulation from O(n²) to amortized O(n). The encoder receives an equivalent change, replacing tuple concatenation with list.append() and list.extend(reversed(res)). See the pyasn1 security patch commit for the complete diff.

Detection Methods for CVE-2026-59885

Indicators of Compromise

Sustained high CPU utilization in Python worker processes correlated with inbound ASN.1, X.509, SNMP, or LDAP traffic
Repeated timeouts or hung requests in services that parse certificates or ASN.1 structures
Small inbound payloads (few kilobytes) preceding worker unresponsiveness or process restarts

Detection Strategies

Inventory Python environments for pyasn1 versions below 0.6.4 using pip list or software composition analysis tooling
Instrument decoder call sites with timing metrics to flag decode operations exceeding expected thresholds
Deploy WAF or proxy rules that reject ASN.1 payloads containing OIDs with an unreasonable number of arcs

Monitoring Recommendations

Alert on prolonged single-core CPU saturation in application workers handling certificate or directory traffic
Track request latency percentiles for endpoints that parse ASN.1 data and investigate sudden tail-latency spikes
Log and rate-limit clients submitting oversized or malformed ASN.1 structures

How to Mitigate CVE-2026-59885

Immediate Actions Required

Upgrade pyasn1 to version 0.6.4 or later in all Python environments
Audit transitive dependencies, since libraries such as pyasn1-modules, pysnmp, and various cryptographic tools pull pyasn1 in indirectly
Restart long-running Python services after upgrading to ensure the patched module is loaded

Patch Information

The issue is fixed in pyasn1 version 0.6.4. Refer to the GitHub Release v0.6.4 and the GitHub Security Advisory GHSA-8ppf-4f7h-5ppj for full details. The fix replaces tuple concatenation with list operations in both the decoder and encoder OID handling paths.

Workarounds

Enforce strict size limits on ASN.1 payloads at ingress proxies before they reach Python decoders
Run ASN.1 decoding in isolated worker processes with CPU time limits so a single request cannot exhaust the host
Where feasible, validate that OID arc counts fall within application-defined bounds before invoking decode()

bash

# Upgrade pyasn1 to the patched release
pip install --upgrade 'pyasn1>=0.6.4'

# Verify the installed version
python -c "import pyasn1; print(pyasn1.__version__)"

# Audit dependency tree for pinned vulnerable versions
pip list --format=columns | grep -i pyasn1
pip install pipdeptree && pipdeptree -p pyasn1