CVE-2026-59886

What it actually does

CVE-2026-59886 is a denial-of-service flaw in pyasn1 before version 0.6.4. The vulnerable univ.Real ASN.1 type can parse a very small BER, CER, or DER encoded REAL value containing an extremely large exponent, then perform exact big-integer exponentiation when the value is converted to a Python float. That conversion can be triggered by common operations such as prettyPrint(), str(), comparison, arithmetic, int(), or explicit float() conversion. Applications that decode untrusted ASN.1 data and then log, print, compare, or otherwise process decoded REAL objects can consume excessive CPU and memory, causing hangs, worker exhaustion, process crashes, or service unavailability. The issue is remotely reachable where attacker-controlled ASN.1 input is accepted over a network and requires no authentication or user interaction in exposed parsing paths.

Why it matters to the business

Successful exploitation can make affected Python-based services or products unavailable by tying up CPU and memory with a small malicious ASN.1 payload. This can interrupt authentication, certificate, directory, messaging, automation, database-adjacent, or other workflows that rely on ASN.1 parsing through pyasn1. The vulnerability has a high availability impact and low attack complexity, but current public exploitation signals are limited: it is not listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS at 0.00335, and has no known exploit maturity in the provided data. Organizations using affected Red Hat packages or products should still remediate because denial-of-service payloads are typically simple to operationalize once details are understood.

How an attack unfolds

An attacker identifies an application endpoint, protocol handler, upload path, API, message queue consumer, or backend integration that accepts BER, CER, or DER encoded ASN.1 data and decodes it using a vulnerable pyasn1 version. The attacker crafts a compact ASN.1 REAL value with a very large exponent. Parsing the ASN.1 object may initially succeed because the payload itself is small. The denial-of-service condition is triggered when the application later renders or converts the decoded value, for example while generating logs, calling prettyPrint(), converting the object to a string, comparing it with another value, performing arithmetic, or converting it to int or float. At that point pyasn1 performs expensive exact big-integer exponentiation and attempts to convert the result to a Python float, driving excessive CPU and memory use. Repeated requests or messages can exhaust worker pools, increase latency, trigger process restarts, or make the service unavailable.

How to fix it

Upgrade pyasn1 to version 0.6.4 or later wherever it is used directly or bundled transitively. For Red Hat packaged environments, apply the relevant RHSA-2026:50340 updates, including python3.12-pyasn1 fixed in 0.6.4-1.el8ap for el8 and 0.6.4-1.el9ap for el9. Also apply fixed product builds where applicable: ansible-automation-platform fixed in 26/lightspeed-rhel9:1785775360, ansible-automation-platform-26/lightspeed fixed in chatbot-rhel9:1785646188, ansible-automation-platform-27/lightspeed fixed in chatbot-rhel9:1785426734, mariadb11-8-main fixed in 11.8.8-3.hum1, and rhtas/model fixed in transparency-rhel9:1785420425. If immediate patching is not possible, reduce exposure by rejecting untrusted ASN.1 REAL values where not required, enforcing strict input size and schema validation, isolating ASN.1 decoding in resource-limited worker processes, applying CPU and memory limits, rate-limiting unauthenticated ASN.1-bearing requests, and avoiding logging or pretty-printing attacker-controlled decoded ASN.1 objects before validation.

How to confirm the fix worked

Confirm that all runtime environments import pyasn1 version 0.6.4 or later, including virtual environments, containers, packaged appliances, and vendor-bundled Python dependencies. Use package inventory tools such as pip show pyasn1, pip freeze, rpm -q python3.12-pyasn1, container image scanners, and software composition analysis to identify remaining vulnerable copies. Validate Red Hat remediation by confirming installed package versions and advisory RHSA-2026:50340 applicability. Exercise representative ASN.1 ingestion paths with benign BER, CER, or DER data and confirm normal operation after upgrade. Where safe test harnesses exist, regression-test handling of ASN.1 REAL values with large exponents under CPU and memory monitoring to verify that conversion no longer causes unbounded resource consumption. Also confirm that input validation, rate limits, worker timeouts, and resource limits are active on externally reachable ASN.1 parsing paths.

Typical attack path

1. Find a network-exposed service, API, protocol listener, or ingestion workflow that accepts ASN.1 BER, CER, or DER data.
2. Confirm or infer that the service uses pyasn1 before 0.6.4 or a product/package that embeds a vulnerable pyasn1 build.
3. Craft a small encoded ASN.1 REAL value whose mantissa/base/exponent combination contains an extremely large exponent.
4. Submit the malicious ASN.1 payload to the target parsing path.
5. Rely on normal application behavior such as logging, pretty-printing, string conversion, comparison, arithmetic, int(), or float() conversion to trigger the expensive conversion.
6. Repeat delivery as needed to consume CPU and memory, exhaust workers, and degrade or deny service.

How to detect it

Look for signs of denial-of-service against services that parse ASN.1 BER, CER, DER, certificates, keys, directory protocol data, authentication messages, or other ASN.1-backed inputs. Useful sources include application logs, reverse proxy logs, API gateway logs, message broker ingestion logs, Python exception and timeout logs, container or orchestrator metrics, host CPU and memory telemetry, process supervision events, and endpoint detection process data. Indicators are more behavioral than signature-based: repeated requests or messages with small payload sizes followed by long processing times, Python processes consuming sustained CPU or rapidly increasing memory, worker timeouts, killed or restarted processes, and logging activity involving pyasn1 REAL values immediately before service degradation. Search code and logs for operations that may trigger conversion of decoded ASN.1 values, including prettyPrint(), str(), float(), int(), comparisons, and arithmetic. If packet capture or request body logging is available, inspect suspicious BER/CER/DER payloads for ASN.1 REAL encodings containing unusually large exponent fields. No named threat actors or ransomware use are provided for this vulnerability, so detection should focus on exploitation symptoms and suspicious ASN.1 inputs rather than actor-specific infrastructure.

• pyasn1.type.univ.Real
• prettyPrint()
• float()
• int()
• pyasn1
• REAL
• BER
• CER
• DER
• python3.12-pyasn1
• pyasn1==0.6.3
• pyasn1==0.6.2
• pyasn1==0.6.1
• pyasn1==0.6.0
• pyasn1<0.6.4
• Killed process
• MemoryError
• CPU time limit exceeded
• worker timeout
• request timeout
• RHSA-2026:50340

What your security team should do

• Prioritize patching internet-facing or unauthenticated services that decode ASN.1 data using pyasn1, especially services that log or pretty-print decoded objects.
• Inventory direct and transitive pyasn1 usage across Python applications, containers, vendor products, and Red Hat packages; flag versions earlier than 0.6.4.
• Apply pyasn1 0.6.4 or later, or the applicable RHSA-2026:50340 fixed packages and product builds.
• Review ASN.1 parsing code paths for calls to prettyPrint(), str(), float(), int(), comparisons, arithmetic, and logging on untrusted decoded REAL values.
• Add defensive controls for untrusted ASN.1 ingestion, including schema validation, request rate limits, worker timeouts, and CPU/memory cgroups or process limits.
• Monitor for unexplained Python worker CPU spikes, memory growth, request timeouts, and repeated malformed ASN.1 inputs following publication of the vulnerability.
• Because EPSS is currently low and the issue is not in KEV, sequence remediation after known-exploited critical issues, but do not defer patching of exposed parsing services.