CVE Tracker

CVE-2026-59885 @ Library

Status
not_applicable
Priority
2.25
Match score
4.0
Risk
Other
CVSS
7.5 HIGH
Reason
cpe: pyasn1; pkgs: pyasn1; version: in-range: pyasn1-0.1.9-2
Created
2026-08-03T20:10:49Z
Updated
2026-08-03T20:32:34Z
Closed
2026-08-03T20:32:34Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

PackageCommands
pyasn1-0.1.9-2

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: pyasn1

Same product CVEs in your queue

Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.

CVECVSSKEVSystemsStatus MatchedAlready related
CVE-2026-23490 7.5 Library not_applicable pyasn1 → CVE-2026-59884
CVE-2026-30922 7.5 Library not_applicable pyasn1 → CVE-2026-59884
CVE-2026-59886 7.5 Library not_applicable pyasn1 → CVE-2026-59884

Related CVE (same fix)

This CVE is subordinated to primary CVE-2026-59884 — same product as CVE-2026-59884

Host OS / kernel

OS
Debian GNU/Linux 9 (stretch) (9) · debian
Arch
x86_64
kernel_release
uname -r → 4.9.0-19-amd64
kernel_version
uname -v → #1 SMP Debian 4.9.320-2 (2022-06-30)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.

Determination

Related to primary CVE-2026-59884: same product as CVE-2026-59884

Update status

Add note only

Mitigation log

2026-08-03T20:32:34Z — not_applicable
Related to primary CVE-2026-59884: same product as CVE-2026-59884

References

NVD: CVE-2026-59885