pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (CVE-2026-59885)
pyasn1 versions prior to 0.6.4 contain a vulnerability in the BER/CER/DER decoders and encoders for OBJECT IDENTIFIER and RELATIVE-OID values. The processing of these values exhibits quadratic time complexity relative to the number of arcs, allowing a crafted payload with many arcs to cause significant CPU consumption. This can lead to denial of service in applications decoding untrusted ASN.1 data such as certificates, LDAP, SNMP, or Kerberos. The issue is fixed in pyasn1 version 0.6.4 by improving the arc accumulation to linear time.
AI Analysis
Technical Summary
The pyasn1 library's BER/CER/DER decoders and encoders for OBJECT IDENTIFIER and RELATIVE-OID values process arcs in quadratic time relative to the number of arcs. This inefficiency allows an attacker to craft ASN.1 payloads with many arcs that cause excessive CPU usage during decoding or encoding, resulting in denial of service. The previously introduced arc-size limit for CVE-2026-23490 does not mitigate this issue because it does not limit the number of arcs. The vulnerability affects ObjectIdentifierPayloadDecoder and RelativeOIDPayloadDecoder in pyasn1/codec/ber/decoder.py and their encoder counterparts. The issue is resolved in pyasn1 version 0.6.4 by changing the arc accumulation to linear time complexity.
Potential Impact
An attacker can cause denial of service by sending specially crafted ASN.1 data containing OBJECT IDENTIFIER or RELATIVE-OID values with many arcs. This leads to excessive CPU consumption during decoding or encoding, potentially impacting any application using pyasn1 to process untrusted ASN.1 data such as certificates, LDAP, SNMP, or Kerberos. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade pyasn1 to version 0.6.4 or later, where the vulnerability is fixed by improving the arc accumulation algorithm to linear time. As a workaround, limit the size of untrusted ASN.1 input before decoding to reduce the risk of denial of service. No other mitigations are specified.
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (CVE-2026-59885)
Description
pyasn1 versions prior to 0.6.4 contain a vulnerability in the BER/CER/DER decoders and encoders for OBJECT IDENTIFIER and RELATIVE-OID values. The processing of these values exhibits quadratic time complexity relative to the number of arcs, allowing a crafted payload with many arcs to cause significant CPU consumption. This can lead to denial of service in applications decoding untrusted ASN.1 data such as certificates, LDAP, SNMP, or Kerberos. The issue is fixed in pyasn1 version 0.6.4 by improving the arc accumulation to linear time.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The pyasn1 library's BER/CER/DER decoders and encoders for OBJECT IDENTIFIER and RELATIVE-OID values process arcs in quadratic time relative to the number of arcs. This inefficiency allows an attacker to craft ASN.1 payloads with many arcs that cause excessive CPU usage during decoding or encoding, resulting in denial of service. The previously introduced arc-size limit for CVE-2026-23490 does not mitigate this issue because it does not limit the number of arcs. The vulnerability affects ObjectIdentifierPayloadDecoder and RelativeOIDPayloadDecoder in pyasn1/codec/ber/decoder.py and their encoder counterparts. The issue is resolved in pyasn1 version 0.6.4 by changing the arc accumulation to linear time complexity.
Potential Impact
An attacker can cause denial of service by sending specially crafted ASN.1 data containing OBJECT IDENTIFIER or RELATIVE-OID values with many arcs. This leads to excessive CPU consumption during decoding or encoding, potentially impacting any application using pyasn1 to process untrusted ASN.1 data such as certificates, LDAP, SNMP, or Kerberos. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade pyasn1 to version 0.6.4 or later, where the vulnerability is fixed by improving the arc accumulation algorithm to linear time. As a workaround, limit the size of untrusted ASN.1 input before decoding to reduce the risk of denial of service. No other mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8ppf-4f7h-5ppj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59885"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a600ac89c2644c7f8fe3c0a
Added to database: 07/22/2026, 00:11:52 UTC
Last enriched: 07/22/2026, 00:57:14 UTC
Last updated: 07/22/2026, 01:13:12 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.