VDB

CVE-2026-59884

CVE-2026-59884 PUBLISHED CVSS 7.5 HIGH

Reported by GitHub_M · Published July 14, 2026

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
pyasn1pyasn1< 0.6.4
chainguardkubeflow-pipelines0, 0, 0
chainguarddbt-bigquery0, 0, 0
wolfikubeflow-pipelines0, 0, 0
chainguardwazuh-manager0, 0
wolfimlflow0, 0, 0
chainguardauthentik-2026.20, 0, 0
chainguardsuperset-6.00, 0, 0
chainguardopenstack-keystone-2025.10, 0, 0
chainguardauthentik-fips-2026.50, 0, 0
chainguarddatahub-ingestion0, 0, 0
chainguardopenstack-keystone-2026.10, 0, 0
wolfikserve0, 0, 0
wolfipy3-cassandra-medusa0, 0, 0
chainguardapache-beam-python-3.12-sdk0, 0, 0
wolfiairflow-30, 0, 0
wolfisuperset-6.00, 0, 0
chainguardpy3-cassandra-medusa0, 0, 0
chainguardlmcache-cuda-12.80
chainguardmlflow0, 0, 0

…and 11 more

Timeline

  • Jul 14, 2026 Coalition ESS Score
  • Jul 14, 2026 CVE Published
  • Aug 1, 2026 Security Advisory
  • Aug 7, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›