Denial of Service Vulnerability in pyasn1 Library for Python

CVE-2026-59885

What is CVE-2026-59885?

The pyasn1 library, a versatile ASN.1 implementation for Python, is susceptible to a denial of service condition due to inefficient processing of OBJECT IDENTIFIER and RELATIVE-OID values. Prior to version 0.6.4, these operations are performed in quadratic time relative to the number of arcs, resulting in significant CPU consumption for a specially crafted payload. This vulnerability exposes applications to potential service disruption when decoding untrusted ASN.1 data, underscoring the need for prompt updates to mitigate such risks. The issue has been addressed in version 0.6.4.

References