CVE-2026-59884

What it actually does

CVE-2026-59884 is a denial-of-service flaw in pyasn1 versions prior to 0.6.4. The BER decoder used by BER, CER, and DER parsing accepts long-form ASN.1 tags without enforcing an upper bound on tag identifier length. A maliciously crafted ASN.1 payload can cause pyasn1 to build extremely large integers while parsing tag continuation bytes, producing quadratic CPU consumption and, on Python 3.11 and later, potentially triggering unhandled ValueError exceptions during integer error formatting. Applications, agents, and services that decode untrusted BER, CER, or DER data may become slow, unresponsive, or crash.

Why it matters to the business

An unauthenticated remote attacker may be able to degrade or interrupt services that process externally supplied ASN.1 data, causing outages, failed telemetry or authentication workflows, increased latency, and resource exhaustion. The CVSS score of 7.5 reflects high availability impact, but EPSS is currently low at 0.00349 and the issue is not listed in CISA KEV, indicating no confirmed broad exploitation at this time. Organizations using affected downstream packages, including Red Hat jaeger-main builds that bundle or depend on vulnerable pyasn1 behavior, should still prioritize remediation for internet-facing or high-volume parsing services because exploitation requires only crafted input and no authentication.

How an attack unfolds

An attacker identifies an application endpoint, protocol listener, ingestion path, or file-processing workflow that passes untrusted ASN.1 BER, CER, or DER content to pyasn1. The attacker sends a payload containing a long-form ASN.1 tag with an excessive number of continuation octets. Vulnerable pyasn1 versions repeatedly accumulate those bytes into a tag identifier without a practical size limit, forcing expensive big-integer operations whose CPU cost grows disproportionately as the tag length increases. On Python 3.11 or later, error-handling paths may also raise an unhandled ValueError when formatting oversized integers. Repeated requests or submitted files can consume worker CPU, exhaust request-processing capacity, trigger crashes, and cause application-level denial of service.

How to fix it

Upgrade pyasn1 to version 0.6.4 or later wherever it is present directly or transitively. For Red Hat jaeger-main, apply the fixed build 2.19.0-1.1.hum1 from RHSA-2026:40236. Rebuild and redeploy containers, virtual environments, Python wheels, and vendor-bundled components that include vulnerable pyasn1 versions. If immediate upgrading is not possible, reduce exposure by rejecting untrusted ASN.1 input where feasible, enforcing strict request and file size limits, applying parsing timeouts, limiting worker concurrency impact, and rate-limiting unauthenticated sources that can submit BER/CER/DER content. Do not rely on increasing Python integer formatting limits as a mitigation; the core issue is unbounded parsing work.

How to confirm the fix worked

Confirm that all runtime environments resolve pyasn1 to version 0.6.4 or later using package inventory, SBOMs, container scans, and runtime checks such as `python -c "import pyasn1; print(pyasn1.__version__)"`. For Red Hat jaeger-main, verify the installed package version is 2.19.0-1.1.hum1 or later and that RHSA-2026:40236 has been applied. Validate that rebuilt containers and deployments no longer contain older pyasn1 artifacts in site-packages, vendored dependency directories, or embedded wheels. Where safe and authorized, run a controlled negative test with malformed ASN.1 long-form tags against non-production test systems to confirm parsing fails quickly without sustained CPU spikes or unhandled exceptions. Monitor post-upgrade service CPU, request latency, and parser error rates to ensure the mitigation is effective.

Typical attack path

1. Find a service, API, agent, collector, or parser that accepts ASN.1-encoded BER, CER, or DER data from untrusted sources.
2. Submit a crafted ASN.1 object containing an oversized long-form tag identifier with many continuation bytes.
3. Cause the vulnerable pyasn1 decoder to spend excessive CPU constructing and handling an arbitrarily large tag integer.
4. Optionally trigger unhandled Python 3.11+ ValueError exceptions during error formatting.
5. Repeat the request or submit multiple malformed objects to tie up workers, increase latency, or crash the affected process.

How to detect it

Look for evidence of attempted or successful denial of service rather than data theft. Useful sources include application logs, Python exception traces, web/API gateway logs, reverse proxy logs, container and orchestration events, process supervisor logs, EDR telemetry, APM traces, and host CPU metrics. Investigate periods with sudden CPU saturation in Python processes, increased request latency, worker timeouts, container restarts, or crashes that coincide with malformed ASN.1 parsing errors. In Python 3.11+ environments, search for unhandled ValueError messages related to integer string conversion limits, especially when stack traces include pyasn1 BER, CER, or DER decoder modules. Network detection can look for ASN.1 long-form tag encodings where the initial tag byte uses high-tag-number form followed by an abnormal run of continuation bytes, particularly repeated submissions from the same source. Because public exploitation is not currently indicated and EPSS is low, absence of known threat-actor indicators is expected; focus on behavioral signs such as repeated malformed ASN.1 payloads paired with resource exhaustion.

• pyasn1.codec.ber.decoder
• pyasn1.codec.cer.decoder
• pyasn1.codec.der.decoder
• ValueError: Exceeds the limit (4300 digits) for integer string conversion
• use sys.set_int_max_str_digits() to increase the limit
• integer string conversion
• ASN.1
• BER decoder
• CER decoder
• DER decoder
• malformed ASN.1
• long-form tag
• high-tag-number form
• \x1f[\x80-\xff]{32,}[\x00-\x7f]
• site-packages/pyasn1/codec/ber/decoder.py
• site-packages/pyasn1/codec/cer/decoder.py
• site-packages/pyasn1/codec/der/decoder.py

What your security team should do

• Inventory applications, containers, agents, and appliances that use Python pyasn1, especially services accepting certificates, Kerberos/LDAP-related data, SNMP-like payloads, telemetry, tracing, or other ASN.1-encoded input.
• Prioritize upgrades for internet-facing services and high-availability platforms; deploy pyasn1 0.6.4 or later and Red Hat jaeger-main 2.19.0-1.1.hum1 or later where applicable.
• Add or verify input size limits, request timeouts, worker isolation, and rate limits on endpoints that decode ASN.1 data from untrusted sources.
• Search logs and monitoring data for unexplained CPU saturation, worker restarts, parser exceptions, and spikes in malformed ASN.1 decoding errors since publication.
• Create detection logic for ASN.1 long-form tag sequences with unusually large continuation-byte runs and correlate with service CPU spikes or process crashes.
• Track vendor advisories for downstream products that bundle pyasn1, because updating the system Python package alone may not remediate vendored copies.