Summary
It was discovered that pyasn1 did not properly bound the size of long-form
tag identifiers when parsing BER, CER, or DER encoded data. An attacker
could possibly use this issue to cause applications decoding untrusted
ASN.1 data to consume excessive CPU resources, resulting in a denial of
service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59884)
It was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID
values in quadratic time relative to the number of arcs. An attacker could
possibly use this issue to cause applications decoding untrusted ASN.1 data
to consume excessive CPU resources, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
and Ubuntu 20.04 LTS. (CVE-2026-59885)
It was discovered that pyasn1 incorrectly handled conversion of decoded
REAL values to Python float types. An attacker could possibly use this
issue to cause applications decoding untrusted ASN.1 data to consume
excessive CPU and memory resources, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
and Ubuntu 20.04 LTS. (CVE-2026-59886)
It was discovered that pyasn1 incorrectly handled tracking component types
when decoding containers without a schema. An attacker could possibly use
this issue to cause applications decoding untrusted ASN.1 data to consume
excessive CPU resources, resulting in a denial of service. This issue only
affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119194)
It was discovered that pyasn1 processed fragmented constructed strings and
indefinite-length ANY values in quadratic time. An attacker could possibly
use this issue to cause applications decoding untrusted ASN.1 data to
consume excessive CPU resources, resulting in a denial of service. This
issue was only addressed in Ubuntu 26.04 LTS and Ubuntu 26.10.
(CVE-2026-119195)
It was discovered that pyasn1 processed fragmented constructed BIT STRING
values in quadratic time. An attacker could possibly use this issue to
cause applications decoding untrusted ASN.1 data to consume excessive CPU
resources, resulting in a denial of service. (CVE-2026-119196)
It was discovered that pyasn1 processed binary-encoded REAL values with
large mantissas in quadratic time. An attacker could possibly use this
issue to cause applications decoding untrusted ASN.1 data to consume
excessive CPU resources, resulting in a denial of service.
(CVE-2026-119197)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | pyasn1 | 0.4.8-1ubuntu0.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | pyasn1 | 0.4.8-4ubuntu0.4 |
| Ubuntu · 26.04 LTS 26.04:LTS | pyasn1 | 0.6.3-1ubuntu0.2 |
| Ubuntu · 26.10 | pyasn1 | 0.6.4-1ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | pyasn1 | 0.1.7-1ubuntu2.1+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | pyasn1 | 0.1.9-1ubuntu0.1~esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | pyasn1 | 0.4.2-3ubuntu0.18.04.1~esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | pyasn1 | 0.4.2-3ubuntu0.20.04.1~esm2 |
Vulnerabilities 7
-
High 7.5
pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding
pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or…
-
High 7.5
pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or …
-
High 7.5
pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fra…
-
High 7.5
pyasn1: Quadratic-complexity denial of service in binary REAL decoding
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a…
-
High 7.5
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction …
-
High 7.5
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consum…
-
High 7.5
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a…
References
-
report
https://ubuntu.com/security/CVE-2026-59884
-
report
https://ubuntu.com/security/CVE-2026-59885
-
report
https://ubuntu.com/security/CVE-2026-59886
-
report
https://ubuntu.com/security/CVE-2026-119194
-
report
https://ubuntu.com/security/CVE-2026-119195
-
report
https://ubuntu.com/security/CVE-2026-119196
-
report
https://ubuntu.com/security/CVE-2026-119197