CVE-2026-59886: pyasn1 Library DoS Vulnerability

CVE-2026-59886 Overview

CVE-2026-59886 is a resource exhaustion vulnerability in pyasn1, a generic ASN.1 library for Python. Versions prior to 0.6.4 convert the mantissa, base, and exponent of a univ.Real value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent. Decoding untrusted ASN.1 data and then invoking prettyPrint(), str(), int(), float(), comparison, or arithmetic operations triggers excessive CPU and memory consumption. The issue is classified under [CWE-400] (Uncontrolled Resource Consumption) and is fixed in version 0.6.4.

Critical Impact

A few bytes of malicious ASN.1 input can hang applications that decode, log, or compare pyasn1 Real values, causing denial of service.

Affected Products

• pyasn1 versions prior to 0.6.4
• Python applications that decode untrusted BER, CER, or DER ASN.1 data using pyasn1
• Downstream libraries and tools that render, log, or compare decoded ASN.1 objects

Discovery Timeline

• 2026-07-14 - CVE-2026-59886 published to NVD
• 2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-59886

Vulnerability Analysis

The flaw resides in how pyasn1 reconstructs an ASN.1 REAL value into a native Python float. ASN.1 REAL encodings represent a value as the tuple (mantissa, base, exponent). During conversion, pyasn1 computed mantissa * base ** exponent using Python's arbitrary-precision integer arithmetic before converting to float.

An attacker can craft a REAL value only a few bytes long that encodes an extremely large exponent. Python evaluates the exponentiation exactly, producing an integer with billions of digits. This consumes significant CPU cycles and memory before the result is ever cast to a float. The condition is [CWE-400] Uncontrolled Resource Consumption.

Any code path that triggers the numeric conversion, including prettyPrint(), str(), int(), float(), and comparison or arithmetic operators, activates the expensive computation. Applications that decode ASN.1 data from remote peers, then log or diff the results, are directly exposed.

Root Cause

The normalization routine used integer division that preserved arbitrary precision and did not bound the exponent before exponentiation. Combined with unrestricted base ** exponent evaluation, a small encoded input expands into a very large intermediate integer.

Attack Vector

Exploitation requires no authentication or user interaction. An attacker sends a crafted ASN.1 payload containing a REAL type with an oversized exponent. When the receiving application decodes and then prints, logs, compares, or converts the value, the process hangs and consumes memory until it is terminated or the host degrades.

     def __normalizeBase10(value):
         m, b, e = value
         while m and m % 10 == 0:
-            m /= 10
+            m //= 10
             e += 1
         return m, b, e

Source: GitHub Commit e60c691. The patch replaces true division with floor division in __normalizeBase10 as part of the broader fix that bounds Real conversion in version 0.6.4.

Detection Methods for CVE-2026-59886

Indicators of Compromise

• Python processes sustaining 100% CPU utilization after receiving ASN.1, X.509, PKCS, SNMP, or LDAP traffic
• Rapid memory growth in services that call pyasn1 decoders followed by prettyPrint(), str(), or comparison operators
• Hung worker threads or timeouts in TLS certificate validators, SNMP agents, or Kerberos tooling that depend on pyasn1

Detection Strategies

• Inventory Python environments for pyasn1 versions below 0.6.4 using pip list or software bill of materials scanning
• Add application-level timeouts around ASN.1 decode and stringification calls to surface hangs originating from untrusted input
• Enable Python fault handlers or py-spy sampling in production to capture stack traces stuck inside integer exponentiation

Monitoring Recommendations

• Alert on unexpected sustained CPU or resident memory growth in services that parse certificates, tokens, or SNMP messages
• Log the size and origin of ASN.1 payloads accepted from untrusted networks for post-incident correlation
• Correlate process hangs with recent ingress of BER, CER, or DER encoded data to identify targeted denial of service attempts

How to Mitigate CVE-2026-59886

Immediate Actions Required

• Upgrade pyasn1 to version 0.6.4 or later in every Python environment, container image, and virtual environment
• Rebuild and redeploy applications and services that vendor pyasn1 through transitive dependencies
• Restart long-running Python processes so the patched module is loaded into memory

Patch Information

The fix is available in pyasn1 0.6.4. See the GitHub Release v0.6.4 and the GitHub Security Advisory GHSA-hm4w-wwcw-mr6r for full remediation details. The upstream code change is in commit e60c691.

Workarounds

• Avoid calling prettyPrint(), str(), int(), float(), or comparison operators on decoded univ.Real values sourced from untrusted input until patched
• Enforce strict size limits on inbound ASN.1 payloads at the network or application boundary
• Run ASN.1 decoding in a subprocess with CPU and memory ulimits so a hang is contained and recoverable

# Configuration example
pip install --upgrade 'pyasn1>=0.6.4'
pip list --format=columns | grep pyasn1