The vulnerability CVE-2026-59884 in the pyasn1 library's BER decoder arises from unbounded accumulation of continuation octets when parsing long-form tags. This can be exploited by an attacker supplying specially crafted BER, CER, or DER input to cause the construction of an arbitrarily large integer, resulting in quadratic CPU cost and denial of service. On Python 3.11 and later, this may also trigger unhandled ValueError exceptions. Exploitation requires that an application passes untrusted ASN.1 input directly to the pyasn1 decoder. Many common uses of pyasn1 involve trusted data and are not exposed. Red Hat has released an update for the jaeger RPMs in Red Hat Hardened Images to version 2.19.0-1.1.hum1 which includes the fix.

The impact is limited to availability, causing denial of service due to excessive CPU consumption in applications using vulnerable pyasn1 versions when decoding untrusted ASN.1 BER, CER, or DER input. There is no confidentiality or integrity impact. Exploitation requires passing untrusted input to the pyasn1 decoder, which is not typical in many deployments. The denial of service affects the Python process consuming the input but typically recovers automatically in service deployments.

A patch is available in the updated jaeger RPMs version 2.19.0-1.1.hum1 included in Red Hat Hardened Images. Users should update to this version or later to remediate the vulnerability. Applications that do not process untrusted ASN.1 BER, CER, or DER input are at reduced risk. No additional mitigation is required beyond applying the official update.