CVE-2026-59885

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.

• CWE-400
• CWE-407

• https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9Patch
• https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4Release Notes
• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppjThird Party Advisory

Published

Jul 14, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5988A vulnerability was detected in Tenda F451 1.0.0.7. This imp…8.8
• CVE-2026-59880Immutable.js provides many Persistent Immutable data structu…7.5
• CVE-2026-59881AIOHTTP is an asynchronous HTTP client/server framework for …6.9
• CVE-2026-59882guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…6.5
• CVE-2026-59883Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, Co…6.1
• CVE-2026-59884pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4…7.5
• CVE-2026-59886pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4…7.5
• CVE-2026-59887linkify-it is a links recognition library with full Unicode …7.5
• CVE-2026-59888jackson-databind contains the general-purpose data-binding f…6.5
• CVE-2026-59889jackson-databind contains the general-purpose data-binding f…6.5
• CVE-2026-5989A flaw has been found in Tenda F451 1.0.0.7. Affected is the…8.8
• CVE-2026-59890setuptools is a package that allows users to download, build…6.1