CVE-2026-59884

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

Impact

The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.

Any application decoding untrusted BER/CER/DER input is affected.

Affected components

• pyasn1.codec.ber.decoder — decode() and StreamingDecoder
• pyasn1.codec.cer.decoder and pyasn1.codec.der.decoder, which inherit the same tag parsing
• pyasn1.type.tag — Tag/TagSet reprs could raise ValueError when rendering oversized tag IDs (reachable through decoder error paths)

The encoders and the pyasn1.codec.native codec are not affected.

Patches

Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.

Workarounds

Bound the size of untrusted input passed to decode() before calling it.

Abstract Syntax Notation One (ASN.1) is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python.

Security Fix(es):

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.(CVE-2026-59884)

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.(CVE-2026-59885)

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.(CVE-2026-59886)

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.

These are all security issues fixed in the python313-pyasn1-0.6.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-pyasn1 fixes the following issues:

• CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).
• CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (bsc#1271465).
• CVE-2026-59886: uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).

Root has patched CVE-2026-59884 in the pyasn1 package for Root:PyPI. Multiple fixed versions available.

This update for python-pyasn1 fixes the following issues:

• CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).
• CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (bsc#1271465).
• CVE-2026-59886: uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).

This update for python-pyasn1 fixes the following issues:

• CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).
• CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (bsc#1271465).
• CVE-2026-59886: uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).

This update for python-pyasn1 fixes the following issues:

This update for python-pyasn1 fixes the following issues:

• CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).
• CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (bsc#1271465).
• CVE-2026-59886: uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).

This update for python-pyasn1 fixes the following issues:

• CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).
• CVE-2026-59885: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (bsc#1271465).
• CVE-2026-59886: Uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).

This update for python-pyasn1 fixes the following issues:

• CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).
• CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (bsc#1271465).
• CVE-2026-59886: uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).

It was discovered that pyasn1 did not properly bound the size of long-form tag identifiers when parsing BER, CER, or DER encoded data. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-59884)

It was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-59885)

It was discovered that pyasn1 incorrectly handled conversion of decoded REAL values to Python float types. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU and memory resources, resulting in a denial of service. (CVE-2026-59886)