Resource exhaustion in Pyasn1
CVE-2026-59886
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.006 (48.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 48.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Pyasn1 — versions < 0.6.4
Weakness classification (CWE)
References
- github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r (Third Party Advisory)
- github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886 (Patch)
- github.com/pyasn1/pyasn1/releases/tag/v0.6.4 (Release Notes)
Frequently asked questions
- What is CVE-2026-59886?
- CVE-2026-59886 is a high-severity vulnerability in Pyasn1, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-07-14.
- How severe is CVE-2026-59886?
- High severity. CVSS v3 base score is 7.5 out of 10.