CVE-2026-59886: pyasn1 Uncontrolled Resource Consumption Vulnerability
Summary
CVE-2026-59886: pyasn1: Uncontrolled resource consumption when converting decoded REAL values. Affects pyasn1 versions < 0.6.4. Fixed in 0.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyasn1 is a pure-Python implementation of ASN.1 (Abstract Syntax Notation One) data structures, widely used for encoding and decoding data in various protocols. It provides a flexible framework for handling ASN.1 types, including INTEGER, BOOLEAN, and REAL. However, the library has a vulnerability that allows for excessive resource consumption when converting decoded REAL values, particularly when dealing with untrusted input.
Vulnerability Detail
The vulnerability arises from the univ.Real type in pyasn1, which converts its (mantissa, base, exponent) representation to a Python float using exact big-integer exponentiation. This can lead to excessive CPU and memory usage when a BER/CER/DER-encoded REAL value with a large exponent is processed. Operations such as prettyPrint(), str(), comparisons, arithmetic, or explicit float() calls on these decoded values can hang the process, resulting in a denial of service. The issue does not occur during decoding alone, making applications that handle untrusted ASN.1 data particularly susceptible.
How To Fix
Latest published version: 0.6.4 as of 22 Oct 2026
pip install --upgrade "pyasn1==0.6.4"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Avoid converting, printing, or comparing decoded Real objects from untrusted sources. Instead, inspect the raw (mantissa, base, exponent) tuple directly. For example, if you have a Real object named 'real_value', you can access its components like this: 'real_value._mantissa', 'real_value._base', 'real_value._exponent'.
Conclusion
The pyasn1 library has a significant vulnerability (CVE-2026-59886) that can lead to uncontrolled resource consumption when handling decoded REAL values from untrusted sources. It is crucial to update to version 0.6.4 or later to mitigate this risk. Additionally, employing workarounds can help protect applications until an update can be applied.
See every vulnerability recorded for pyasn1 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions of pyasn1 up to and including 0.6.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Operations that trigger the vulnerability include float conversion, prettyPrint(), str(), comparisons, and arithmetic on decoded Real objects.
If you cannot update pyasn1 right away, ensure that you do not handle untrusted ASN.1 REAL values in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyasn1.
