Answer in brief
CVE-2026-59884 records a High severity (CVSS 7.5) security vulnerability in pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Answer in brief
CVE-2026-59884 records a High severity (CVSS 7.5) security vulnerability in pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Update pyasn1 to 0.6.4 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-59884 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| pyasn1pip | <0.6.4 | 0.6.4 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-59884 records a High severity (CVSS 7.5) security vulnerability in pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for pyasn1.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate pyasn1 to 0.6.4 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-59884 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| pyasn1pip | <0.6.4 | 0.6.4 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-59884 records a High severity (CVSS 7.5) security vulnerability in pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for pyasn1.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Impact The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling. Any application decoding untrusted BER/CER/DER input is affected. ### Affected components - `pyasn1.codec.ber.decoder` — `decode()` and `StreamingDecoder` - `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit the same tag parsing - `pyasn1.type.tag` — `Tag`/`TagSet` reprs could raise `ValueError` when rendering oversized tag IDs (reachable through decoder error paths) The encoders and the `pyasn1.codec.native` codec are not affected. ### Patches Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit. ### Workarounds Bound the size of untrusted input passed to `decode()` before calling it.
### Impact The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling. Any application decoding untrusted BER/CER/DER input is affected. ### Affected components - `pyasn1.codec.ber.decoder` — `decode()` and `StreamingDecoder` - `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit the same tag parsing - `pyasn1.type.tag` — `Tag`/`TagSet` reprs could raise `ValueError` when rendering oversized tag IDs (reachable through decoder error paths) The encoders and the `pyasn1.codec.native` codec are not affected. ### Patches Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit. ### Workarounds Bound the size of untrusted input passed to `decode()` before calling it.