{"id":"CVE-2026-59885","aliases":["AZL-92430","BELL-CVE-2026-59885","DEBIAN-CVE-2026-59885","EUVD-2026-43955","GHSA-8ppf-4f7h-5ppj","MGASA-2026-0380","OESA-2026-3198","PYSEC-2026-3456","RHSA-2026:40236","RHSA-2026:50319","RHSA-2026:50336","SUSE-SU-2026:22765-1","SUSE-SU-2026:22830-1","SUSE-SU-2026:23006-1","SUSE-SU-2026:23167-1","SUSE-SU-2026:3238-1","UBUNTU-CVE-2026-59885","USN-8712-1","USN-9011-1","openSUSE-SU-2026:11318-1","openSUSE-SU-2026:21392-1"],"status":"published","title":"pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00616,"percentile":0.49985,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-407"],"published":"2026-07-14T16:40:00Z","modified":"2026-11-11T09:40:07Z","fixes":[{"ecosystem":"PyPI","package":"pyasn1","fixed_in":["0.6.4"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"python-pyasn1","fixed_in":["0.4.8-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"py3-asn1","fixed_in":["0.4.8-r6"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"py3-asn1","fixed_in":["0.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-asn1","fixed_in":["0.6.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pyasn1","fixed_in":["0.4.8-3+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pyasn1","fixed_in":["0.6.1-1+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pyasn1","fixed_in":["0.6.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pyasn1","fixed_in":["0.1.7-1ubuntu2.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pyasn1","fixed_in":["0.1.9-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pyasn1","fixed_in":["0.4.2-3ubuntu0.18.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pyasn1","fixed_in":["0.4.2-3ubuntu0.20.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pyasn1","fixed_in":["0.4.8-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"pyasn1","fixed_in":["0.4.8-4ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"pyasn1","fixed_in":["0.6.3-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.6.3"},{"fixed":"0.6.4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"py3-asn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.8-r3"},{"fixed":"0.4.8-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-asn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.1-r0"},{"fixed":"0.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-asn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.8-r2"},{"fixed":"0.6.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-3+deb12u3"}]}],"versions":["0.4.8-3","0.4.8-3+deb12u1","0.4.8-3+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-1+deb13u3"}]}],"versions":["0.6.1-1","0.6.1-1+deb13u1","0.6.1-1+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4-1"}]}],"versions":["0.6.1-1","0.6.2-1","0.6.2-1~bpo13+1","0.6.3-1","0.6.4-1~bpo13+1"]},{"source":"osv","ecosystem":"PyPI","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4"}]}],"versions":["0.0.10a","0.0.11a","0.0.12a","0.0.13","0.0.13a","0.0.13b","0.0.6a","0.0.9a","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.1","0.2.2","0.2.3","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.5.0","0.5.1","0.6.0","0.6.1","0.6.2","0.6.3"]},{"source":"osv","ecosystem":"Mageia:10","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-3.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-6.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1-4.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1-4.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1-4.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4"}]}],"versions":["0.0.10a","0.0.11a","0.0.12a","0.0.13","0.0.13a","0.0.13b","0.0.6a","0.0.9a","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.1","0.2.2","0.2.3","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.5.0","0.5.1","0.6.0","0.6.1","0.6.2","0.6.3"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"jaeger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.19.0-1.1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.21-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-7.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.1-2.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.1-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-7.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-7.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-7.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-daphne","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-daphne","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.31-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.31-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-1.el8ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.1-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.1-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.1-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el10ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el10ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el10ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el10ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.7-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-daphne","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.15-2.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.0-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-1.el9ap"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-160000.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-160000.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-160000.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-slfo.1.1_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-150400.12.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.7-1ubuntu2.1+esm2"}]}],"versions":["0.1.4-0ubuntu1","0.1.7-1ubuntu1","0.1.7-1ubuntu2","0.1.7-1ubuntu2.1","0.1.7-1ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9-1ubuntu0.1~esm2"}]}],"versions":["0.1.8-2","0.1.9-1","0.1.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-3ubuntu0.18.04.1~esm2"}]}],"versions":["0.1.9-2","0.4.2-3","0.4.2-3ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-3ubuntu0.20.04.1~esm2"}]}],"versions":["0.4.2-3","0.4.2-3build1","0.4.2-3ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-1ubuntu0.3"}]}],"versions":["0.4.8-1","0.4.8-1ubuntu0.1","0.4.8-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-4ubuntu0.3"}]}],"versions":["0.4.8-4","0.4.8-4ubuntu0.1","0.4.8-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-1ubuntu0.1"}]}],"versions":["0.6.1-1","0.6.1-1build1","0.6.2-1","0.6.3-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-1ubuntu0.3"}]}],"versions":["0.4.8-1","0.4.8-1ubuntu0.1","0.4.8-1ubuntu0.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-4ubuntu0.3"}]}],"versions":["0.4.8-4","0.4.8-4ubuntu0.1","0.4.8-4ubuntu0.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-1ubuntu0.1"}]}],"versions":["0.6.1-1","0.6.1-1build1","0.6.2-1","0.6.3-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.7-1ubuntu2.1+esm2"}]}],"versions":["0.1.4-0ubuntu1","0.1.7-1ubuntu1","0.1.7-1ubuntu2","0.1.7-1ubuntu2.1","0.1.7-1ubuntu2.1+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9-1ubuntu0.1~esm2"}]}],"versions":["0.1.8-2","0.1.9-1","0.1.9-1ubuntu0.1~esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-3ubuntu0.18.04.1~esm2"}]}],"versions":["0.1.9-2","0.4.2-3","0.4.2-3ubuntu0.18.04.1~esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-3ubuntu0.20.04.1~esm2"}]}],"versions":["0.4.2-3","0.4.2-3build1","0.4.2-3ubuntu0.20.04.1~esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-1ubuntu0.4"}]}],"versions":["0.4.8-1","0.4.8-1ubuntu0.1","0.4.8-1ubuntu0.2","0.4.8-1ubuntu0.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-4ubuntu0.4"}]}],"versions":["0.4.8-4","0.4.8-4ubuntu0.1","0.4.8-4ubuntu0.2","0.4.8-4ubuntu0.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4-1ubuntu0.1"}]}],"versions":["0.6.3-1","0.6.4-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-1ubuntu0.2"}]}],"versions":["0.6.1-1","0.6.1-1build1","0.6.2-1","0.6.3-1","0.6.3-1ubuntu0.1"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-160000.5.1"}]}],"bundled":3}],"products":[{"vendor":"pyasn1","product":"pyasn1"}],"references":[{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web","article","report"]},{"url":"https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9","tags":["x_refsource_MISC","Patch","fix","web","article"]},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4","tags":["x_refsource_MISC","Release Notes","web","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59885","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8ppf-4f7h-5ppj"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-59885","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59885.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59885","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0380.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36249","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8712-1","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j","tags":["advisory","article"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59886","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40236","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59884","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59885","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40236.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59884","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500380","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59885","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50319","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497452","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2497466","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500043","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50319.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12383","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12383","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","tags":["advisory"]},{"url":"https://go.dev/cl/783621","tags":["article"]},{"url":"https://go.dev/issue/79694","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5037","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33811","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","tags":["advisory"]},{"url":"https://go.dev/cl/767860","tags":["article"]},{"url":"https://go.dev/issue/78803","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4981","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467820","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","tags":["advisory"]},{"url":"https://go.dev/cl/759940","tags":["article"]},{"url":"https://go.dev/issue/78566","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4986","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40898","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40898","tags":["advisory"]},{"url":"https://github.com/quic-go/quic-go/releases/tag/v0.59.1","tags":["article"]},{"url":"https://github.com/quic-go/quic-go/security/advisories/GHSA-vvgj-x9jq-8cj9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467809","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","tags":["advisory"]},{"url":"https://go.dev/cl/771520","tags":["article"]},{"url":"https://go.dev/issue/78987","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4977","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44545","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44545","tags":["advisory"]},{"url":"https://github.com/django/daphne/blob/main/CHANGELOG.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48526","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526","tags":["advisory"]},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54059","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54059","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54059","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54060","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55379","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55380","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55380","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59197","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59197","tags":["advisory"]},{"url":"https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/pull/9695","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59886","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50336","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508155","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50336.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18141","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622765-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271464","tags":["report"]},{"url":"https://bugzilla.suse.com/1271465","tags":["report"]},{"url":"https://bugzilla.suse.com/1271466","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59886","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622830-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623006-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623167-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263238-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59885","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-9011-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-119194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-119195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-119196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-119197","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59885","title":"pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.","status":"published","published":"2026-07-14T16:40:00.515Z","modified":"2026-07-14T17:32:43.678Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-43955","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.","status":"published","published":"2026-07-14T16:40:00Z","modified":"2026-07-14T17:32:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:59.200665Z"}],"ghsa":[{"id":"GHSA-8ppf-4f7h-5ppj","title":"pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service","description":"### Impact\nThe BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload (tens of kilobytes) containing an OID with many arcs consumes seconds of CPU per decode() call, allowing denial of service in any application that decodes untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos, etc.). The corresponding encoders have the same quadratic behavior, reachable when an application re-encodes previously decoded attacker-supplied values.\n\nThe arc-size limit introduced for CVE-2026-23490 bounds the byte length of an individual arc but not the number of arcs, so it does not mitigate this issue.\n\n### Affected components\nObjectIdentifierPayloadDecoder and RelativeOIDPayloadDecoder in pyasn1/codec/ber/decoder.py; ObjectIdentifierEncoder and RelativeOIDEncoder in pyasn1/codec/ber/encoder.py. The CER and DER codecs inherit these and are equally affected.\n\n### Patches\nFixed in pyasn1 0.6.4: arc accumulation in both decoders and encoders now runs in linear time.\n\n### Workarounds\nLimit the size of untrusted ASN.1 input before decoding.","status":"published","published":"2026-07-21T19:11:03Z","modified":"2026-07-21T19:11:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:40:50.444681Z"}],"nvd":[{"id":"CVE-2026-59885","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.","status":"published","published":"2026-07-14T17:17:14.88Z","modified":"2026-07-21T14:38:21.58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:12:29.489525Z"}],"osv":[{"id":"BELL-CVE-2026-59885","status":"published","published":"2026-07-17T06:04:28.556835Z","modified":"2026-07-22T07:15:10.847951021Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-59885","title":"pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.","status":"published","published":"2026-07-14T16:40:00.515Z","modified":"2026-10-28T02:31:01.773348994Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"DEBIAN-CVE-2026-59885","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.","status":"published","published":"2026-07-14T17:17:14.88Z","modified":"2026-10-01T03:03:28.538229433Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-8ppf-4f7h-5ppj","title":"pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service","description":"### Impact\nThe BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload (tens of kilobytes) containing an OID with many arcs consumes seconds of CPU per decode() call, allowing denial of service in any application that decodes untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos, etc.). The corresponding encoders have the same quadratic behavior, reachable when an application re-encodes previously decoded attacker-supplied values.\n\nThe arc-size limit introduced for CVE-2026-23490 bounds the byte length of an individual arc but not the number of arcs, so it does not mitigate this issue.\n\n### Affected components\nObjectIdentifierPayloadDecoder and RelativeOIDPayloadDecoder in pyasn1/codec/ber/decoder.py; ObjectIdentifierEncoder and RelativeOIDEncoder in pyasn1/codec/ber/encoder.py. The CER and DER codecs inherit these and are equally affected.\n\n### Patches\nFixed in pyasn1 0.6.4: arc accumulation in both decoders and encoders now runs in linear time.\n\n### Workarounds\nLimit the size of untrusted ASN.1 input before decoding.","status":"published","published":"2026-07-21T19:11:03Z","modified":"2026-09-10T03:51:11.103855167Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"OESA-2026-3198","title":"python-pyasn1 security update","description":"Abstract Syntax Notation One (ASN.1) is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python.\r\n\r\nSecurity Fix(es):\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.(CVE-2026-59884)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.(CVE-2026-59885)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.(CVE-2026-59886)","status":"published","published":"2026-08-01T11:12:04Z","modified":"2026-08-18T01:21:25.858554012Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"PYSEC-2026-3456","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.","status":"published","published":"2026-07-14T17:17:14.88Z","modified":"2026-07-22T11:00:08.814095424Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"RHSA-2026:40236","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-17T10:09:43Z","modified":"2026-10-20T10:08:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:50319","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-08-05T10:37:39Z","modified":"2026-10-20T10:10:26Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50336","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-08-05T10:37:39Z","modified":"2026-10-20T10:10:26Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-59885","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.","status":"published","published":"2026-07-14T17:17:00Z","modified":"2026-11-11T09:40:07.48400708Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T10:02:12.942344Z"},{"id":"AZL-92430","title":"CVE-2026-59885 affecting package python-pyasn1 for versions less than 0.4.8-3","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.","status":"published","published":"2026-07-14T17:17:14Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.880689Z"},{"id":"MGASA-2026-0380","title":"Updated python-pyasn1 packages fix security vulnerabilities","description":"The BER decoder (shared by the CER and DER codecs) parses long-form tags\nby accumulating continuation octets in a loop with no upper bound on the\nsize of the tag ID. A crafted input can force the decoder to build an\narbitrarily large integer, with CPU cost growing quadratically in input\nsize — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the\noversized tag ID can also trigger an unhandled ValueError (integer\nstring conversion limit) while the decoder formats error messages,\nviolating the documented PyAsn1Error contract and potentially bypassing\ncaller error handling.\n","status":"published","published":"2026-09-07T18:46:11Z","modified":"2026-09-07T19:00:02.713123042Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11318-1","title":"python313-pyasn1-0.6.4-1.1 on GA media","description":"These are all security issues fixed in the python313-pyasn1-0.6.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-20T00:00:00Z","modified":"2026-07-21T09:45:08.247634268Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21392-1","title":"Security update for python-pyasn1","description":"This update for python-pyasn1 fixes the following issues:\n\n- CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).\n- CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service\n  (bsc#1271465).\n- CVE-2026-59886: uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).\n","status":"published","published":"2026-07-20T12:16:10Z","modified":"2026-07-24T18:24:22.981496631Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22765-1","title":"Security update for python-pyasn1","description":"This update for python-pyasn1 fixes the following issues:\n\n- CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).\n- CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service\n  (bsc#1271465).\n- CVE-2026-59886: uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).\n","status":"published","published":"2026-07-20T12:15:58Z","modified":"2026-07-23T18:24:20.602690643Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22830-1","title":"Security update for python-pyasn1","description":"This update for python-pyasn1 fixes the following issues:\n\n- CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).\n- CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service\n  (bsc#1271465).\n- CVE-2026-59886: uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).\n","status":"published","published":"2026-07-20T12:15:58Z","modified":"2026-07-28T18:24:08.280549143Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23006-1","title":"Security update for python-pyasn1","description":"This update for python-pyasn1 fixes the following issues:\n\nThis update for python-pyasn1 fixes the following issues:\n\n- CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).\n- CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service\n  (bsc#1271465).\n- CVE-2026-59886: uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).\n","status":"published","published":"2026-07-28T06:34:03Z","modified":"2026-08-12T18:23:35.926619812Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23167-1","title":"Security update for python-pyasn1","description":"This update for python-pyasn1 fixes the following issues:\n\n- CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).\n- CVE-2026-59885: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service\n  (bsc#1271465).\n- CVE-2026-59886: Uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).\n","status":"published","published":"2026-08-06T11:19:02Z","modified":"2026-08-22T18:23:34.575642833Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3238-1","title":"Security update for python-pyasn1","description":"This update for python-pyasn1 fixes the following issues:\n\n- CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs (bsc#1271464).\n- CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service\n  (bsc#1271465).\n- CVE-2026-59886: uncontrolled resource consumption when converting decoded REAL values (bsc#1271466).\n","status":"published","published":"2026-07-24T12:56:30Z","modified":"2026-07-28T18:24:15.25825058Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8712-1","title":"pyasn1 vulnerabilities","description":"It was discovered that pyasn1 did not properly bound the size of long-form\ntag identifiers when parsing BER, CER, or DER encoded data. An attacker\ncould possibly use this issue to cause applications decoding untrusted\nASN.1 data to consume excessive CPU resources, resulting in a denial of\nservice. (CVE-2026-59884)\n\nIt was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID\nvalues in quadratic time relative to the number of arcs. An attacker could\npossibly use this issue to cause applications decoding untrusted ASN.1 data\nto consume excessive CPU resources, resulting in a denial of service.\n(CVE-2026-59885)\n\nIt was discovered that pyasn1 incorrectly handled conversion of decoded\nREAL values to Python float types. An attacker could possibly use this\nissue to cause applications decoding untrusted ASN.1 data to consume\nexcessive CPU and memory resources, resulting in a denial of service.\n(CVE-2026-59886)","status":"published","published":"2026-09-01T16:20:26Z","modified":"2026-09-02T02:41:28.700081773Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-9011-1","title":"pyasn1 vulnerabilities","description":"It was discovered that pyasn1 did not properly bound the size of long-form\ntag identifiers when parsing BER, CER, or DER encoded data. An attacker\ncould possibly use this issue to cause applications decoding untrusted\nASN.1 data to consume excessive CPU resources, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59884)\n\nIt was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID\nvalues in quadratic time relative to the number of arcs. An attacker could\npossibly use this issue to cause applications decoding untrusted ASN.1 data\nto consume excessive CPU resources, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nand Ubuntu 20.04 LTS. (CVE-2026-59885)\n\nIt was discovered that pyasn1 incorrectly handled conversion of decoded\nREAL values to Python float types. An attacker could possibly use this\nissue to cause applications decoding untrusted ASN.1 data to consume\nexcessive CPU and memory resources, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nand Ubuntu 20.04 LTS. (CVE-2026-59886)\n\nIt was discovered that pyasn1 incorrectly handled tracking component types\nwhen decoding containers without a schema. An attacker could possibly use\nthis issue to cause applications decoding untrusted ASN.1 data to consume\nexcessive CPU resources, resulting in a denial of service. This issue only\naffected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04\nLTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119194)\n\nIt was discovered that pyasn1 processed fragmented constructed strings and\nindefinite-length ANY values in quadratic time. An attacker could possibly\nuse this issue to cause applications decoding untrusted ASN.1 data to\nconsume excessive CPU resources, resulting in a denial of service. This\nissue was only addressed in Ubuntu 26.04 LTS and Ubuntu 26.10.\n(CVE-2026-119195)\n\nIt was discovered that pyasn1 processed fragmented constructed BIT STRING\nvalues in quadratic time. An attacker could possibly use this issue to\ncause applications decoding untrusted ASN.1 data to consume excessive CPU\nresources, resulting in a denial of service. (CVE-2026-119196)\n\nIt was discovered that pyasn1 processed binary-encoded REAL values with\nlarge mantissas in quadratic time. An attacker could possibly use this\nissue to cause applications decoding untrusted ASN.1 data to consume\nexcessive CPU resources, resulting in a denial of service.\n(CVE-2026-119197)","status":"published","published":"2026-11-09T16:15:14Z","modified":"2026-11-11T09:34:57.290482225Z","updated_at":"2026-11-10T03:21:46.325253Z"}]}}