Search: CVE-2026-59885

A denial of service vulnerability exists in the pyasn1 library's BER/CER/DER decoders and encoders when processing OBJECT IDENTIFIER and RELATIVE-OID values. The vulnerability arises from quadratic time complexity relative to the number of arcs in these values, allowing crafted payloads with many arcs to consume excessive CPU time. This affects applications decoding untrusted ASN.1 data such as certificates, LDAP, SNMP, and Kerberos. The issue is fixed in pyasn1 version 0.6.4, which improves the processing to linear time. Users should upgrade to this version or later to mitigate the risk.