CVE-2026-59885

What it actually does

pyasn1 versions prior to 0.6.4 have an algorithmic-complexity denial-of-service flaw in BER, CER, and DER decoding of OBJECT IDENTIFIER and RELATIVE-OID values. A specially crafted ASN.1 payload with an unusually large number of OID arcs causes decode() operations to take quadratic CPU time. Applications that subsequently re-encode attacker-controlled decoded values may trigger the same excessive CPU behavior in the encoder. The vulnerability does not enable code execution or data disclosure, but it can exhaust CPU and make affected Python services unresponsive when they parse untrusted ASN.1 input.

Why it matters to the business

Services that accept ASN.1-encoded data from untrusted sources can be slowed or taken offline by small malicious inputs, causing outages, failed authentication or certificate-processing workflows, degraded observability pipelines, and increased infrastructure load. The issue has a high availability impact but currently has low EPSS probability, no known CISA KEV listing, and no reported ransomware use; however, because pyasn1 is commonly embedded transitively in Python applications, exposure may exist through dependencies rather than direct application code.

How an attack unfolds

An attacker identifies an exposed workflow that decodes ASN.1 data using vulnerable pyasn1 versions, such as certificate, Kerberos, LDAP, SNMP, PKI, SAML-adjacent, or other protocol-processing paths. The attacker sends a small BER, CER, or DER payload containing an OBJECT IDENTIFIER or RELATIVE-OID with a very large number of arcs. When the application calls pyasn1 decode(), the decoder performs inefficient repeated work and consumes CPU time disproportionate to the input size. Repeated requests or concurrent connections can pin worker processes or event-loop threads, causing request latency, timeouts, health-check failures, autoscaling pressure, and service denial. If the application re-encodes the attacker-supplied decoded value, the encoder can amplify CPU consumption further. No public exploit maturity is reported, but the attack is low-complexity where untrusted ASN.1 parsing is reachable over the network.

How to fix it

Upgrade pyasn1 to version 0.6.4 or later wherever it is installed directly or pulled in transitively. For the listed Red Hat packages, apply RHSA-2026:50319 and upgrade to the fixed builds: jaeger-main 2.19.0-1.1.hum1, python3.12-pyasn1 0.6.4-1.el8ap on Red Hat Enterprise Linux 8, and python3.12-pyasn1 0.6.4-1.el9ap on Red Hat Enterprise Linux 9. Rebuild and redeploy container images, virtual environments, Python wheels, and application bundles that vendor pyasn1. If immediate patching is not possible, restrict untrusted ASN.1 inputs, enforce request body size and parsing time limits, limit OID arc counts where feasible, add rate limiting, isolate ASN.1 parsing in resource-constrained workers, and ensure CPU-based autoscaling or circuit breakers cannot be abused for cost amplification.

How to confirm the fix worked

Confirm all runtime environments report pyasn1 0.6.4 or later using package inventory, dependency lockfiles, container image scans, and runtime checks such as `python -c "import pyasn1; print(pyasn1.__version__)"`. Validate operating system packages show the fixed Red Hat builds from RHSA-2026:50319. Review dependency trees for vendored or transitive copies using tools such as pipdeptree, pip freeze, rpm queries, SBOMs, and container scanners. Exercise representative ASN.1 parsing workflows in a test environment with benign high-arc OID samples and confirm CPU usage remains bounded after upgrade. Verify mitigations by checking request size limits, timeouts, rate limits, and worker resource limits are enforced before ASN.1 decoding can monopolize CPU.

Typical attack path

1. Discover an internet-facing or internally reachable service that parses ASN.1 BER, CER, or DER input using pyasn1 before version 0.6.4.
2. Craft an ASN.1 payload containing an OBJECT IDENTIFIER or RELATIVE-OID with an excessive number of arcs.
3. Submit the payload to a protocol endpoint, file upload, API parameter, message queue, or authentication/certificate-processing path that reaches pyasn1 decode().
4. Trigger quadratic CPU consumption during decoding, and potentially again during re-encoding if the application serializes the decoded attacker-controlled value.
5. Repeat or parallelize requests to exhaust CPU, saturate workers, cause timeouts, and deny service to legitimate users.

How to detect it

To assess possible prior exploitation, review application, API gateway, reverse proxy, load balancer, and service logs for bursts of requests immediately preceding CPU saturation, worker timeouts, 5xx responses, or health-check failures on endpoints that process ASN.1, certificates, authentication tokens, LDAP/SNMP/Kerberos/PKI data, or uploaded binary payloads. Correlate system metrics for high CPU with low network bandwidth, small request bodies, repeated client retries, and elevated Python process CPU time. Inspect application logs for pyasn1 decoder exceptions or unusually slow decode operations involving OBJECT IDENTIFIER, RELATIVE-OID, BER, CER, or DER handling. In containerized deployments, review pod restarts, OOM-adjacent events caused by stalled workers, readiness/liveness probe failures, and autoscaling events. Network payloads may be DER/BER encoded and not human-readable, so prioritize metadata patterns: many small ASN.1-bearing requests from the same source, abnormal request rates to parsing endpoints, and CPU spikes without matching traffic volume. There are no unique public exploit strings or malware artifacts for this vulnerability, so detection should be behavior- and telemetry-based.

• pyasn1
• OBJECT IDENTIFIER
• RELATIVE-OID
• RelativeOID
• univ.ObjectIdentifier
• univ.RelativeOID
• pyasn1.codec.ber.decoder
• pyasn1.codec.cer.decoder
• pyasn1.codec.der.decoder
• pyasn1.codec.ber.encoder
• pyasn1.codec.cer.encoder
• pyasn1.codec.der.encoder
• SubstrateUnderrunError
• PyAsn1Error
• Too many clients
• upstream timed out
• worker timeout
• readiness probe failed
• liveness probe failed
• context deadline exceeded

What your security team should do

• Prioritize patching internet-facing and authentication-, certificate-, LDAP-, SNMP-, Kerberos-, telemetry-, or PKI-related services that parse ASN.1 with Python dependencies.
• Upgrade pyasn1 to 0.6.4 or later and apply RHSA-2026:50319 fixed packages for affected Red Hat deployments.
• Search SBOMs, container images, virtual environments, and dependency lockfiles for pyasn1 versions earlier than 0.6.4, including transitive dependencies.
• Add application-layer protections for untrusted ASN.1 input, including request limits, parsing timeouts, rate limits, and resource isolation.
• Monitor for CPU spikes, worker exhaustion, request timeouts, and repeated malformed ASN.1 parsing errors from the same source addresses.
• Because this is not currently KEV-listed and EPSS is low, sequence remediation behind actively exploited remote-code-execution issues, but do not defer patching for exposed ASN.1 parsers with high availability requirements.