CVE-2026-59884Medium· 5.9▾ SunlitA flaw was found in pyasn1, a generic ASN.1 library for Python. The Basic Encoding Rules (BER) decoder, used by CER and DER codecs, processes long-form tags by accumulating continuation octets without an upper bound. A remote attacker can …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
0.3% → 0.6%
7.5 → 5.9
high → medium
Last analysed / modified upstream
A flaw was found in pyasn1, a generic ASN.1 library for Python. The Basic Encoding Rules (BER) decoder, used by CER and DER codecs, processes long-form tags by accumulating continuation octets without an upper bound. A remote attacker can exploit this by providing a specially crafted input, leading to the construction of an arbitrarily large integer. This can cause the CPU cost to grow quadratically, resulting in a Denial of Service (DoS) for any application decoding untrusted BER, CER, or DER input.
python-pyasn1: pyasn1: Denial of Service via crafted BER input — rated Moderate by Red Hat. Released 2026-07-14, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
For more information visit https://access.redhat.com/errata/RHSA-2026:59518 https://access.redhat.com/errata/RHSA-2026:59518 For more information visit https://access.redhat.com/errata/RHSA-2026:83121 https://access.redhat.com/errata/RHSA-2026:83121 The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command.
For details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.3 https://access.redhat.com/errata/RHSA-2026:62336
Workarounds / mitigations:
Affected packages:
pyasn1 < 0.6.4Patched in:
pyasn1 0.6.4Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59200High· 7.5Pillow: Pillow: Denial of service via crafted PDF stream (CVE-2026-59200)
CVE-2026-59885High· 7.5pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885)
CVE-2026-59204High· 7.5Pillow: Pillow: Denial of Service via crafted JPEG2000 image (CVE-2026-59204)
CVE-2026-55379High· 7.5python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
CVE-2026-54283High· 7.5starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS (CVE-2026-54283)
CVE-2026-55685Medium· 6.5react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests (CVE-2026-55685)