CVE-2026-59886

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.

• CWE-400
• CWE-770

• https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886Patch
• https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4Release Notes
• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6rThird Party Advisory

Published

Jul 14, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59880Immutable.js provides many Persistent Immutable data structu…7.5
• CVE-2026-59881AIOHTTP is an asynchronous HTTP client/server framework for …6.9
• CVE-2026-59882guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…6.5
• CVE-2026-59883Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, Co…6.1
• CVE-2026-59884pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4…7.5
• CVE-2026-59885pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4…7.5
• CVE-2026-59887linkify-it is a links recognition library with full Unicode …7.5
• CVE-2026-59888jackson-databind contains the general-purpose data-binding f…6.5
• CVE-2026-59889jackson-databind contains the general-purpose data-binding f…6.5
• CVE-2026-5989A flaw has been found in Tenda F451 1.0.0.7. Affected is the…8.8
• CVE-2026-59890setuptools is a package that allows users to download, build…6.1
• CVE-2026-59891sigstore-js provides JavaScript libraries for interacting wi…9.6