{"id":"CVE-2026-59884","title":"python-pyasn1: pyasn1: Denial of Service via crafted BER input (CVE-2026-59884)","summary":"A flaw was found in pyasn1, a generic ASN.1 library for Python. The Basic Encoding Rules (BER) decoder, used by CER and DER codecs, processes long-form tags by accumulating continuation octets without an upper bound. A remote attacker can …","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-770","CWE-400"],"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","affected":["exploit_intelligence","lightspeed_core","migration_toolkit_for_applications 8","migration_toolkit_for_containers","migration_toolkit_for_virtualization","openshift_lightspeed","openshift_service_mesh 3","advanced_cluster_management_for_kubernetes 2","ai_inference_server","ansible_automation_platform 2","ceph_storage 7","ceph_storage 8","ceph_storage 9","enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_container_platform 4","openstack_platform 16.2","openstack_platform 17.1","openstack_platform 18.0","quay 3","satellite 6","trusted_artifact_signer","service_telemetry_framework 1.5","ai_inference_server 3.3","ai_inference_server 3.4","enterprise_linux_ai 3.3","hardened_images","openshift_ai 3.3","openshift_ai 3.4"],"patched":["ai_inference_server 3.3","ai_inference_server 3.4","enterprise_linux_ai 3.3","hardened_images","openshift_ai 3.3","openshift_ai 3.4"],"published":"2026-07-14","updated":"2026-10-19","sourceUpdated":"2026-10-19T11:47:07+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59884.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59884.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59884"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500204"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59884"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59884"},{"url":"https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"},{"url":"https://access.redhat.com/errata/RHSA-2026:59518"},{"url":"https://access.redhat.com/errata/RHSA-2026:83121"},{"url":"https://access.redhat.com/errata/RHSA-2026:62336"},{"url":"https://access.redhat.com/errata/RHSA-2026:62335"},{"url":"https://access.redhat.com/errata/RHSA-2026:40236"},{"url":"https://access.redhat.com/errata/RHSA-2026:73987"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"url":"https://github.com/pyasn1/pyasn1"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml"},{"url":"https://github.com/advisories/GHSA-m4p7-r5rc-7g4j"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa"],"epss":0.00616,"epssPercentile":0.49309,"aliases":["GHSA-m4p7-r5rc-7g4j","PYSEC-2026-3455"],"ecosystem":"pip","scores":{"vendor":5.9,"osv":7.5},"ingestedAt":"2026-07-21T19:53:40.133Z","slug":"CVE-2026-59884","body":"## Overview\n\nA flaw was found in pyasn1, a generic ASN.1 library for Python. The Basic Encoding Rules (BER) decoder, used by CER and DER codecs, processes long-form tags by accumulating continuation octets without an upper bound. A remote attacker can exploit this by providing a specially crafted input, leading to the construction of an arbitrarily large integer. This can cause the CPU cost to grow quadratically, resulting in a Denial of Service (DoS) for any application decoding untrusted BER, CER, or DER input.\n\n## Vendor advisories\n\n- **RHSA-2026:59518** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59518)\n- **RHSA-2026:83121** · Red Hat · fixed in: Red Hat AI Inference Server 3.4 · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83121)\n- **RHSA-2026:62336** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62336)\n- **RHSA-2026:62335** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62335)\n- **RHSA-2026:40236** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:40236)\n- **RHSA-2026:73987** · Red Hat · fixed in: Red Hat OpenShift AI 3.3 · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73987)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)\n- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)\n- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Migration Toolkit for Virtualization, OpenShift Lightspeed, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat AI Inference Server, Exploit Intelligence, Lightspeed Core, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59884.json)\n\n**python-pyasn1: pyasn1: Denial of Service via crafted BER input** — rated Moderate by Red Hat. Released 2026-07-14, updated 2026-10-19.\n\nAffected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Migration Toolkit for Virtualization\n- OpenShift Lightspeed\n- OpenShift Service Mesh 3\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n- Red Hat OpenStack Platform 18.0\n- Red Hat Quay 3\n- Red Hat Satellite 6\n- Red Hat Trusted Artifact Signer\n- Service Telemetry Framework 1.5\n\nFixed:\n\n- Red Hat AI Inference Server 3.3\n- Red Hat AI Inference Server 3.4\n- Red Hat Enterprise Linux AI 3.3\n- Red Hat Hardened Images\n- Red Hat OpenShift AI 3.3\n- Red Hat OpenShift AI 3.4\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Red Hat AI Inference Server\n- Exploit Intelligence\n- Lightspeed Core\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Migration Toolkit for Virtualization\n- OpenShift Lightspeed\n- OpenShift Service Mesh 3\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n- Red Hat OpenStack Platform 18.0\n- Red Hat Quay 3\n- Red Hat Satellite 6\n- Red Hat Trusted Artifact Signer\n- Service Telemetry Framework 1.5\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Red Hat Enterprise Linux AI 3.3\n- Red Hat OpenShift AI 3.3\n- Red Hat OpenShift AI 3.4\n- Red Hat Hardened Images\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nFor more information visit https://access.redhat.com/errata/RHSA-2026:59518 https://access.redhat.com/errata/RHSA-2026:59518\nFor more information visit https://access.redhat.com/errata/RHSA-2026:83121 https://access.redhat.com/errata/RHSA-2026:83121\nThe container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the \"podman pull\" command.\n\nFor details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.3 https://access.redhat.com/errata/RHSA-2026:62336\n\nWorkarounds / mitigations:\n\n- Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.\n\n## Package advisory (CVE-2026-59884)\n\nAffected packages:\n\n- `pyasn1 < 0.6.4`\n\nPatched in:\n\n- `pyasn1 0.6.4`\n\nSource: https://osv.dev/vulnerability/GHSA-m4p7-r5rc-7g4j","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":214194,"id":"CVE-2026-59884","ts":1790841345572,"field":"cvss","old":"7.5","new":"5.9"},{"seq":214193,"id":"CVE-2026-59884","ts":1790841345572,"field":"severity","old":"high","new":"medium"}]}