High severity · published Jul 14, 2026
CVE-2026-59885
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
pyasn1 · pyasn1
< 0.6.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59885
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59885
Patch
https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9
Release Notes
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4
Third Party Advisory
https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj
More from pyasn1
7.5
CVE-2026-59884
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
7.5
CVE-2026-59886
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
7.5
CVE-2026-30922
pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
7.5
CVE-2026-23490
pyasn1 is a generic ASN.1 library for Python