Vulnerability-Lookup

OPENSUSE-SU-2026:11318-1

Vulnerability from csaf_opensuse - Published: 2026-07-20 00:00 - Updated: 2026-07-20 00:00

Summary

python313-pyasn1-0.6.4-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: python313-pyasn1-0.6.4-1.1 on GA media

Description of the patch: These are all security issues fixed in the python313-pyasn1-0.6.4-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11318

CVE-2026-59884

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-59885

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-59886

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64	—	Vendor Fix

Threats

Impact important

References

11 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-59884/	self
https://www.suse.com/security/cve/CVE-2026-59885/	self
https://www.suse.com/security/cve/CVE-2026-59886/	self
https://www.suse.com/security/cve/CVE-2026-59884	external
https://bugzilla.suse.com/1271464	external
https://www.suse.com/security/cve/CVE-2026-59885	external
https://bugzilla.suse.com/1271465	external
https://www.suse.com/security/cve/CVE-2026-59886	external
https://bugzilla.suse.com/1271466	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python313-pyasn1-0.6.4-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python313-pyasn1-0.6.4-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11318",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11318-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59884 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59884/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59885 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59885/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59886 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59886/"
      }
    ],
    "title": "python313-pyasn1-0.6.4-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-07-20T00:00:00Z",
      "generator": {
        "date": "2026-07-20T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11318-1",
      "initial_release_date": "2026-07-20T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-07-20T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-pyasn1-0.6.4-1.1.aarch64",
                "product": {
                  "name": "python313-pyasn1-0.6.4-1.1.aarch64",
                  "product_id": "python313-pyasn1-0.6.4-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-pyasn1-0.6.4-1.1.aarch64",
                "product": {
                  "name": "python314-pyasn1-0.6.4-1.1.aarch64",
                  "product_id": "python314-pyasn1-0.6.4-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-pyasn1-0.6.4-1.1.ppc64le",
                "product": {
                  "name": "python313-pyasn1-0.6.4-1.1.ppc64le",
                  "product_id": "python313-pyasn1-0.6.4-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python314-pyasn1-0.6.4-1.1.ppc64le",
                "product": {
                  "name": "python314-pyasn1-0.6.4-1.1.ppc64le",
                  "product_id": "python314-pyasn1-0.6.4-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-pyasn1-0.6.4-1.1.s390x",
                "product": {
                  "name": "python313-pyasn1-0.6.4-1.1.s390x",
                  "product_id": "python313-pyasn1-0.6.4-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python314-pyasn1-0.6.4-1.1.s390x",
                "product": {
                  "name": "python314-pyasn1-0.6.4-1.1.s390x",
                  "product_id": "python314-pyasn1-0.6.4-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-pyasn1-0.6.4-1.1.x86_64",
                "product": {
                  "name": "python313-pyasn1-0.6.4-1.1.x86_64",
                  "product_id": "python313-pyasn1-0.6.4-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-pyasn1-0.6.4-1.1.x86_64",
                "product": {
                  "name": "python314-pyasn1-0.6.4-1.1.x86_64",
                  "product_id": "python314-pyasn1-0.6.4-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-pyasn1-0.6.4-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64"
        },
        "product_reference": "python313-pyasn1-0.6.4-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-pyasn1-0.6.4-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le"
        },
        "product_reference": "python313-pyasn1-0.6.4-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-pyasn1-0.6.4-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x"
        },
        "product_reference": "python313-pyasn1-0.6.4-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-pyasn1-0.6.4-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64"
        },
        "product_reference": "python313-pyasn1-0.6.4-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-pyasn1-0.6.4-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64"
        },
        "product_reference": "python314-pyasn1-0.6.4-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-pyasn1-0.6.4-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le"
        },
        "product_reference": "python314-pyasn1-0.6.4-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-pyasn1-0.6.4-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x"
        },
        "product_reference": "python314-pyasn1-0.6.4-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-pyasn1-0.6.4-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64"
        },
        "product_reference": "python314-pyasn1-0.6.4-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-59884",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59884"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64",
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x",
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59884",
          "url": "https://www.suse.com/security/cve/CVE-2026-59884"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271464 for CVE-2026-59884",
          "url": "https://bugzilla.suse.com/1271464"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59884"
    },
    {
      "cve": "CVE-2026-59885",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59885"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64",
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x",
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59885",
          "url": "https://www.suse.com/security/cve/CVE-2026-59885"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271465 for CVE-2026-59885",
          "url": "https://bugzilla.suse.com/1271465"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59885"
    },
    {
      "cve": "CVE-2026-59886",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59886"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64",
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x",
          "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x",
          "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59886",
          "url": "https://www.suse.com/security/cve/CVE-2026-59886"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271466 for CVE-2026-59886",
          "url": "https://bugzilla.suse.com/1271466"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python313-pyasn1-0.6.4-1.1.x86_64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.aarch64",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.s390x",
            "openSUSE Tumbleweed:python314-pyasn1-0.6.4-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-20T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59886"
    }
  ]
}

CVE-2026-59884 (GCVE-0-2026-59884)

Vulnerability from cvelistv5 – Published: 2026-07-14 16:41 – Updated: 2026-07-15 13:50

Title

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

Summary

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/pyasn1/pyasn1/security/advisor…	x_refsource_CONFIRM
https://github.com/pyasn1/pyasn1/commit/628e36ecb…	x_refsource_MISC
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pyasn1	pyasn1	Affected: < 0.6.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59884",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T13:50:17.314569Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T13:50:29.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyasn1",
          "vendor": "pyasn1",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.6.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T16:41:10.277Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
        }
      ],
      "source": {
        "advisory": "GHSA-m4p7-r5rc-7g4j",
        "discovery": "UNKNOWN"
      },
      "title": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59884",
    "datePublished": "2026-07-14T16:41:10.277Z",
    "dateReserved": "2026-07-07T16:40:07.982Z",
    "dateUpdated": "2026-07-15T13:50:29.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59885 (GCVE-0-2026-59885)

Vulnerability from cvelistv5 – Published: 2026-07-14 16:40 – Updated: 2026-07-14 17:32

Title

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

Summary

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-407 - Inefficient Algorithmic Complexity

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/pyasn1/pyasn1/security/advisor…	x_refsource_CONFIRM
https://github.com/pyasn1/pyasn1/commit/45bdb19eb…	x_refsource_MISC
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pyasn1	pyasn1	Affected: < 0.6.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59885",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T17:32:32.986793Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T17:32:43.678Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyasn1",
          "vendor": "pyasn1",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.6.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T16:40:00.515Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
        }
      ],
      "source": {
        "advisory": "GHSA-8ppf-4f7h-5ppj",
        "discovery": "UNKNOWN"
      },
      "title": "pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59885",
    "datePublished": "2026-07-14T16:40:00.515Z",
    "dateReserved": "2026-07-07T16:40:07.983Z",
    "dateUpdated": "2026-07-14T17:32:43.678Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59886 (GCVE-0-2026-59886)

Vulnerability from cvelistv5 – Published: 2026-07-14 16:38 – Updated: 2026-07-15 15:44

Title

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

Summary

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/pyasn1/pyasn1/security/advisor…	x_refsource_CONFIRM
https://github.com/pyasn1/pyasn1/commit/e60c691cb…	x_refsource_MISC
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pyasn1	pyasn1	Affected: < 0.6.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59886",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T15:43:46.620953Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T15:44:02.717Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyasn1",
          "vendor": "pyasn1",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.6.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T16:38:29.691Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
        }
      ],
      "source": {
        "advisory": "GHSA-hm4w-wwcw-mr6r",
        "discovery": "UNKNOWN"
      },
      "title": "pyasn1: Uncontrolled resource consumption when converting decoded REAL values"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59886",
    "datePublished": "2026-07-14T16:38:29.691Z",
    "dateReserved": "2026-07-07T16:40:07.983Z",
    "dateUpdated": "2026-07-15T15:44:02.717Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

OPENSUSE-SU-2026:11318-1

CVE-2026-59884 (GCVE-0-2026-59884)

CVE-2026-59885 (GCVE-0-2026-59885)

CVE-2026-59886 (GCVE-0-2026-59886)

Tags

Sightings

Nomenclature