CVE-2026-59884 is a denial of service vulnerability in the pyasn1 library's BER/CER/DER decoders caused by unbounded long-form tag IDs. The decoder accumulates continuation octets without an upper limit, allowing crafted inputs to cause excessive CPU usage. On Python 3.11 and later, this can also trigger an unhandled ValueError during error message formatting, potentially bypassing error handling. The issue affects pyasn1 versions from 0.15.0 up to but not including 0.20.0_1 and is fixed in version 0.20.0_1.