CVE-2026-59885: pyasn1 Denial of Service Vulnerability Due to Quadratic Complexity in OID Processing
Summary
CVE-2026-59885: pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service. Affects pyasn1 versions < 0.6.4. Fixed in 0.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyasn1 is a pure-Python implementation of ASN.1 (Abstract Syntax Notation One) data structures, widely used for encoding and decoding data in various applications such as certificates, LDAP, SNMP, and Kerberos. The library allows developers to work with ASN.1 data in a straightforward manner, but it is susceptible to performance issues when handling certain malformed inputs, leading to potential denial of service attacks.
Vulnerability Detail
The vulnerability arises from the BER/CER/DER decoders in pyasn1, which process OBJECT IDENTIFIER and RELATIVE-OID values with quadratic complexity relative to the number of arcs. A crafted payload with many arcs can significantly increase CPU usage during decoding, leading to denial of service in applications that decode untrusted ASN.1 data. This issue is exacerbated by the fact that the encoders exhibit the same quadratic behavior, making it possible for an attacker to exploit this vulnerability through re-encoding previously decoded values.
How To Fix
Latest published version: 0.6.4 as of 22 Oct 2026
pip install --upgrade "pyasn1==0.6.4"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, limit the size of untrusted ASN.1 input before decoding. This can be done by implementing checks in your application to restrict the maximum allowable size of the input data.
Conclusion
In summary, CVE-2026-59885 represents a significant denial of service vulnerability in the pyasn1 library due to inefficient processing of certain ASN.1 data structures. It is crucial for developers using this library to update to the patched version or implement workarounds to mitigate potential risks.
See every vulnerability recorded for pyasn1 →
FAQ
CVE-2026-59885 is a vulnerability in the pyasn1 library that allows for denial of service due to quadratic complexity in processing OBJECT IDENTIFIER and RELATIVE-OID values.
If your application uses pyasn1 to decode untrusted ASN.1 data, it may be susceptible to denial of service attacks, where an attacker can craft inputs that consume excessive CPU resources.
Versions of pyasn1 up to and including 0.6.3 are affected by this vulnerability. Version 0.6.4 and later contain the necessary fixes.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. Without requiring access to the code or installation, you can check your application by using the Pipfile.lock with Vulert's playground.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyasn1.
