Kimi cli: pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (CVE-2026-59885)
Description
A denial of service vulnerability exists in the pyasn1 library's BER/CER/DER decoders and encoders when processing OBJECT IDENTIFIER and RELATIVE-OID values. The vulnerability arises from quadratic time complexity relative to the number of arcs in these values, allowing crafted payloads with many arcs to consume excessive CPU time. This affects applications decoding untrusted ASN.1 data such as certificates, LDAP, SNMP, and Kerberos. The issue is fixed in pyasn1 version 0.6.4, which improves the processing to linear time. Users should upgrade to this version or later to mitigate the risk.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The pyasn1 library's BER/CER/DER decoders and encoders for OBJECT IDENTIFIER and RELATIVE-OID values exhibit quadratic time complexity based on the number of arcs processed. This inefficiency allows an attacker to craft ASN.1 payloads with many arcs that cause excessive CPU consumption during decode() or encode() operations, resulting in denial of service. The previously introduced arc-size limit for CVE-2026-23490 does not mitigate this issue because it limits arc byte length but not the number of arcs. The affected components include ObjectIdentifierPayloadDecoder, RelativeOIDPayloadDecoder, ObjectIdentifierEncoder, and RelativeOIDEncoder. The vulnerability is fixed in pyasn1 version 0.6.4 by changing arc accumulation to linear time complexity.
Potential Impact
An attacker can cause denial of service by sending specially crafted ASN.1 data containing OBJECT IDENTIFIER or RELATIVE-OID values with many arcs, leading to high CPU usage during decoding or encoding. This affects any application using pyasn1 to process untrusted ASN.1 data such as certificates, LDAP, SNMP, or Kerberos. There is no impact on confidentiality or integrity, only availability.
Mitigation Recommendations
A patch is available in pyasn1 version 0.6.4 that fixes the quadratic complexity issue by implementing linear-time arc accumulation. Users should upgrade to version 0.6.4 or later. As a workaround, limit the size of untrusted ASN.1 input before decoding to reduce the risk of denial of service.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8ppf-4f7h-5ppj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59885"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a600ac89c2644c7f8fe3c0a
Added to database: 07/22/2026, 00:11:52 UTC
Last enriched: 09/18/2026, 02:12:51 UTC
Last updated: 10/20/2026, 06:48:17 UTC
Views: 135
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.