CVE-2026-59884
Fixed in a distro release EPSS <1%CVSS 7.5
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
Products: pyasn1
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pyasn1 | 0.6.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-3 | 3.3.0-r4 |
| Chainguard | airflow-3-iamguarded-compat | no fix |
| Chainguard | apache-beam-python-3.12-sdk | 2.75.0-r1 |
| Chainguard | authentik-2026.2 | 2026.2.6-r11 |
| Chainguard | authentik-fips-2026.2 | 2026.2.6-r11 |
| Chainguard | authentik-fips-2026.5 | 2026.5.6-r3 |
| Chainguard | datadog-agent-7.71-core-integrations | no fix |
| Chainguard | datadog-agent-7.72-core-integrations | no fix |
| Chainguard | datadog-agent-7.75-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.71-core-integrations | no fix |
| Chainguard | datadog-agent-fips-7.72-core-integrations | no fix |
| Chainguard | datahub-ingestion | 1.6.0-r5 |
| Chainguard | dbt-bigquery | 1.10.3-r6 |
| Chainguard | duplicity | 3.1.0-r2 |
| Chainguard | kserve | 0.20.0-r7 |
| Chainguard | kserve-localmodel | 0.20.0-r7 |
| Chainguard | kserve-storage-controller | 0.19.0-r5 |
| Chainguard | kserve-storage-controller | no fix |
| Chainguard | kubeflow-pipelines-apiserver | 2.17.2-r4 |
| Chainguard | kubeflow-pipelines-apiserver | 2.17.0-r4 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 2.17.2-r4 |
| Chainguard | lmcache-cuda-12.8 | 0.5.3-r0 |
| Chainguard | localstack | 4.14.0-r20 |
| Chainguard | mlflow | 3.16.0-r0 |
| Chainguard | mlflow | 3.15.0-r1 |
| Chainguard | mlflow-iamguarded-compat | 3.15.0-r1 |
| Chainguard | openstack-keystone-2025.1 | 27.0.1_git20260618-r7 |
| Chainguard | openstack-keystone-2025.2 | 28.0.1_git20260618-r7 |
| Chainguard | openstack-keystone-2026.1 | 29.0.1_git20260616-r7 |
| Chainguard | py3-cassandra-medusa | 0.29.1-r1 |
| Chainguard | superset-6.0 | 6.0.0-r15 |
| Chainguard | wazuh-manager-framework | 4.14.6-r3 |
| Chainguard | wazuh-manager-framework-fips | 4.14.7-r1 |
| Debian 12 | pyasn1 | 0.4.8-3+deb12u3 |
| Debian 13 | pyasn1 | 0.6.1-1+deb13u3 |
| Debian 14 | pyasn1 | 0.6.4-1 |
| Red Hat hummingbird 1 | jaeger | 0:2.19.0-1.1.hum1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise Server 16.0 | python-pyasn1 | 0.6.1-160000.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-pyasn1 | 0.5.0-150400.12.16.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-pyasn1 | 0.6.1-160000.5.1 |
| SUSE Linux Micro 6.0 | python-pyasn1 | 0.5.0-5.1 |
| SUSE Linux Micro 6.1 | python-pyasn1 | 0.5.0-slfo.1.1_4.1 |
| SUSE Linux Micro 6.2 | python-pyasn1 | 0.6.1-160000.5.1 |
| Ubuntu 22.04 LTS | pyasn1 | 0.4.8-1ubuntu0.3 |
| Ubuntu 24.04 LTS | pyasn1 | 0.4.8-4ubuntu0.3 |
| Ubuntu 26.04 LTS | pyasn1 | 0.6.3-1ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | pyasn1 | no fix |
| Ubuntu Pro 16.04 LTS | pyasn1 | no fix |
| Ubuntu Pro 18.04 LTS | pyasn1 | no fix |
| Ubuntu Pro 20.04 LTS | pyasn1 | no fix |
| Wolfi | airflow-3 | 3.3.0-r4 |
| Wolfi | airflow-3-iamguarded-compat | no fix |
| Wolfi | datadog-agent-7.72-core-integrations | no fix |
| Wolfi | datadog-agent-7.75-core-integrations | no fix |
| Wolfi | kserve | 0.20.0-r7 |
| Wolfi | kserve-localmodel | 0.20.0-r7 |
| Wolfi | kserve-storage-controller | 0.19.0-r5 |
| Wolfi | kserve-storage-controller | no fix |
| Wolfi | kubeflow-pipelines-apiserver | 2.17.0-r4 |
| Wolfi | kubeflow-pipelines-apiserver | 2.17.2-r4 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 2.17.2-r4 |
| Wolfi | mlflow | 3.16.0-r0 |
| Wolfi | mlflow | 3.15.0-r1 |
| Wolfi | mlflow-iamguarded-compat | 3.15.0-r1 |
| Wolfi | py3-cassandra-medusa | 0.29.1-r1 |
| Wolfi | superset-6.0 | 6.0.0-r15 |
| openSUSE Leap 16.0 | python-pyasn1 | 0.6.1-160000.5.1 |
| openSUSE Tumbleweed | python-pyasn1 | 0.6.4-1.1 |