CVE-2026-59885: 
Python vulnerability analysis and mitigation

CVE-2026-59885 is a denial-of-service vulnerability in pyasn1, a generic ASN.1 library for Python, caused by quadratic time complexity in OBJECT IDENTIFIER (OID) and RELATIVE-OID processing. All versions up to and including 0.6.3 are affected; the issue is fixed in version 0.6.4. The vulnerability was published on July 9, 2026, by the project maintainer and assigned a CVSS v3.1 base score of 7.5 (High) (Github Advisory, pyasn1 Release).

The root cause is inefficient algorithmic complexity (CWE-407) combined with uncontrolled resource consumption (CWE-400) in the BER, CER, and DER decoders and encoders. Specifically, ObjectIdentifierPayloadDecoder, RelativeOIDPayloadDecoder, ObjectIdentifierEncoder, and RelativeOIDEncoder in pyasn1/codec/ber/decoder.py and encoder.py accumulated arc values using tuple concatenation (oid += (subId,)), which creates a new tuple on every iteration — resulting in O(n²) time complexity relative to the number of arcs. The fix in commit 45bdb19 replaces tuple concatenation with list .append() operations, reducing arc accumulation to linear time. Notably, the arc-size limit introduced for a prior CVE (CVE-2026-23490) bounds individual arc byte length but not the number of arcs, so it does not mitigate this issue (Github Advisory, Patch Commit).

An unauthenticated remote attacker can submit a small crafted ASN.1 payload (tens of kilobytes) containing an OID with many arcs, causing seconds of CPU consumption per decode() call and effectively denying service to any application that processes untrusted ASN.1 data. Affected application domains include certificate parsing, LDAP, SNMP, and Kerberos implementations that rely on pyasn1. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Github Advisory).

1. Identify target: Locate a network-accessible service or application that uses pyasn1 <= 0.6.3 to decode untrusted ASN.1 data (e.g., a TLS certificate parser, LDAP server, SNMP agent, or Kerberos implementation).
2. Craft malicious payload: Construct a BER-encoded OBJECT IDENTIFIER or RELATIVE-OID with a large number of single-byte arcs. For example, a payload with tag 0x06, a length field encoding 4096, followed by 4096 bytes of 0x01 creates an OID with thousands of arcs in only a few kilobytes.
3. Submit payload: Send the crafted ASN.1 payload to the target application through its normal input channel (e.g., as a certificate in a TLS handshake, an SNMP packet, or an LDAP request).
4. Trigger CPU exhaustion: Each call to decode() on the malicious payload causes quadratic CPU consumption due to repeated tuple concatenation, consuming seconds of CPU time per call. Repeated submissions can sustain CPU exhaustion and deny service to legitimate users (Github Advisory, Patch Commit).

• Network: Repeated or high-volume ASN.1-encoded requests (e.g., TLS handshakes, SNMP packets, LDAP queries) from a single or small set of source IPs, particularly with unusually large OID fields.
• Process/System: Sustained high CPU utilization on processes that perform ASN.1 decoding (e.g., Python processes running LDAP, SNMP, or certificate-handling services); CPU spikes correlated with incoming network requests.
• Logs: Application logs showing slow or timed-out decode() operations; error messages referencing OID or RELATIVE-OID processing in pyasn1 stack traces.

Upgrade pyasn1 to version 0.6.4 or later, which fixes arc accumulation in both decoders and encoders to run in linear time (pyasn1 Release). If immediate patching is not possible, limit the size of untrusted ASN.1 input before passing it to decode(), or restrict ASN.1 decoding operations to trusted data sources only (Github Advisory). A Red Hat security errata (RHSA-2026:40236) has also been issued for affected Red Hat products.

The vulnerability was reported by researcher tynus2 and addressed by the pyasn1 maintainer (droideck) in a security release that also fixed two other CVEs (CVE-2026-59884 and CVE-2026-59886) (pyasn1 Release). Red Hat issued a security advisory (RHSA-2026:40236), and the vulnerability has been picked up by Tenable (Nessus plugin 327028) and Qualys (detection ID 6662115), indicating broad scanner coverage. No significant social media discussion or independent researcher commentary has been identified beyond standard vulnerability database entries.