CVE-2026-59884

Name	CVE-2026-59884
Description	pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pyasn1 (PTS)	bullseye	0.4.8-1	vulnerable
	bullseye (security)	0.4.8-1+deb11u2	vulnerable
	bookworm, bookworm (security)	0.4.8-3+deb12u2	vulnerable
	trixie (security), trixie	0.6.1-1+deb13u2	vulnerable
	forky, sid	0.6.3-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pyasn1	source	(unstable)	(unfixed)

Notes

https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j
Fixed by: https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5 (v0.6.4)