CVE-2026-59884

The pyasn1 library implements generic ASN.1 parsing routines for BER, CER, and DER formats. Prior to release 0.6.4 the decoder for long‑form tag identifiers accumulated continuation bytes without applying an upper bound on the resulting tag ID size. An attacker can supply a crafted ASN.1 blob that forces the decoder to build an arbitrarily large integer, causing CPU usage to rise quadratically and eventually raising an unhandled ValueError during Python 3.11+ error formatting. The outcome is an unintentional crash, rendering the application unavailable while processing the malicious data. This vulnerability is a classic example of uncontrolled resource consumption (CWE‑400).

All installations of pyasn1 earlier than 0.6.4 are vulnerable, regardless of the Python interpreter version. Any application – whether a web service, network client, or file processor – that invokes the BER, CER, or DER decoder on untrusted input will be affected. The problem appears in both the CER and DER codecs that share the same internal BER parsing routine.

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% suggests that exploitation attempts are currently rare, and the vulnerability is not included in the CISA KEV list. Based on the description, the likely attack vector is the introduction of malformed ASN.1 data, which could be supplied via any input channel such as a network protocol, HTTP request, or uploaded file. Because the decoder does not enforce a tag‑ID size limit, the flaw can be triggered without additional privileges, leading to a denial‑of‑service crash inside the target process.