CVE-2026-59886 @ Library
Status
not_applicable
Priority
1.75
Match score
4.0
Risk
DoS
CVSS
7.5 HIGH
Reason
cpe: pyasn1; pkgs: pyasn1; version: in-range: pyasn1-0.1.9-2; risk:dos
Created
2026-08-03T20:10:49Z
Updated
2026-08-03T20:32:52Z
Closed
2026-08-03T20:32:52Z
Package interrogation (copy)
Run on the host — click to copy a command. Debian/apt
| Package | Commands |
|---|---|
| pyasn1-0.1.9-2 |
Inventory lookup
Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.
Suggestions: pyasn1
Same product CVEs in your queue
Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.
| CVE | CVSS | KEV | Systems | Status | Matched | Already related | |
|---|---|---|---|---|---|---|---|
| CVE-2026-59885 | 7.5 | Library | not_applicable | pyasn1 | → CVE-2026-59884 | ||
| CVE-2026-23490 | 7.5 | Library | not_applicable | pyasn1 | → CVE-2026-59884 | ||
| CVE-2026-30922 | 7.5 | Library | not_applicable | pyasn1 | → CVE-2026-59884 |
Related CVE (same fix)
This CVE is subordinated to primary CVE-2026-59884 — same product as CVE-2026-59884
Host OS / kernel
OS
Debian GNU/Linux 9 (stretch)
(9)
· debian
Arch
x86_64
kernel_release
uname -r → 4.9.0-19-amd64kernel_version
uname -v → #1 SMP Debian 4.9.320-2 (2022-06-30)For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.
Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.
Determination
Related to primary CVE-2026-59884: same product as CVE-2026-59884
Update status
Add note only
Mitigation log
2026-08-03T20:32:52Z — not_applicable
Related to primary CVE-2026-59884: same product as CVE-2026-59884
References
- https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886
- https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4
- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r
NVD: CVE-2026-59886