Most recent entries from all

bdu:2026-15491

BELL-CVE-2026-59884

Affected: Alpaquita:23: py3-asn1, Alpaquita:25: py3-asn1, Alpaquita:stream: py3-asn1

BREW-ansible-CVE-2026-59884 — pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

Affected: Homebrew: ansible

### Impact The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.

Any application decoding untrusted BER/CER/DER input is affected.

### Affected components - `pyasn1.codec.ber.decoder` — `decode()` and `StreamingDecoder` - `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit the same tag parsing - `pyasn1.type.tag` — `Tag`/`TagSet` reprs could raise `ValueError` when rendering oversized tag IDs (reachable through decoder error paths)

The encoders and the `pyasn1.codec.native` codec are not affected.

### Patches Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.

### Workarounds Bound the size of untrusted input passed to `decode()` before calling it.

Withdrawn: CLEANSTART-2026-BC02149 — Security fixes in airflow-3 3.1.8-r6

Withdrawn by the publisher.

Affected: CleanStart: airflow-3

Package airflow-3 version 3.1.8-r6 fixes 13 vulnerabilities: CVE-2026-53533, CVE-2026-59885, CVE-2026-59886, CVE-2026-59890, CVE-2026-49476...

fkie_cve-2026-59884

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

GHSA-m4p7-r5rc-7g4j — pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

Affected: PyPI: pyasn1

Any application decoding untrusted BER/CER/DER input is affected.

The encoders and the `pyasn1.codec.native` codec are not affected.

### Workarounds Bound the size of untrusted input passed to `decode()` before calling it.

msrc_CVE-2026-59884 — pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

msrc_CVE-2026-59884

OESA-2026-3198 — python-pyasn1 security update

Affected: openEuler:20.03-LTS-SP4: python-pyasn1, openEuler:22.03-LTS-SP4: python-pyasn1, openEuler:24.03-LTS-SP1: python-pyasn1, openEuler:24.03-LTS-SP3: python-pyasn1, openEuler:24.03-LTS-SP4: python-pyasn1

Abstract Syntax Notation One (ASN.1) is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python. Security Fix(es):

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.(CVE-2026-59885)

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base…

openSUSE-SU-2026:11318-1 — python313-pyasn1-0.6.4-1.1 on GA media

python313-pyasn1-0.6.4-1.1 on GA media

PYSEC-2026-3455

Affected: PyPI: pyasn1

RHSA-2026:40236 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

python-pyasn1: pyasn1: Denial of Service via crafted BER input pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER

SUSE-SU-2026:22765-1 — Security update for python-pyasn1

Security update for python-pyasn1

UBUNTU-CVE-2026-59884

Affected: Ubuntu:Pro:14.04:LTS: pyasn1, Ubuntu:Pro:16.04:LTS: pyasn1, Ubuntu:Pro:18.04:LTS: pyasn1, Ubuntu:Pro:20.04:LTS: pyasn1, Ubuntu:22.04:LTS: pyasn1, Ubuntu:24.04:LTS: pyasn1, Ubuntu:26.04:LTS: pyasn1