Arbitrary Integer Construction Vulnerability in pyasn1 Library by pyasn1 Development Team

CVE-2026-59884

What is CVE-2026-59884?

The pyasn1 library, a widely used ASN.1 library for Python, contains a vulnerability in its BER decoder that affects versions prior to 0.6.4. The flaw arises from the decoder's handling of long-form tags, which allows for the accumulation of continuation octets without an upper limit on the tag ID size. As a result, a specially crafted input can lead to the generation of an arbitrarily large integer, resulting in performance degradation due to the quadratic growth of CPU cost. Additionally, this issue can trigger unhandled ValueError exceptions in error formatting paths in Python 3.11 and later. Applications that decode untrusted data using BER, CER, or DER formats are particularly susceptible to this vulnerability.

References