{"id":"USN-8712-1","summary":"pyasn1 vulnerabilities","details":"It was discovered that pyasn1 did not properly bound the size of long-form\ntag identifiers when parsing BER, CER, or DER encoded data. An attacker\ncould possibly use this issue to cause applications decoding untrusted\nASN.1 data to consume excessive CPU resources, resulting in a denial of\nservice. (CVE-2026-59884)\n\nIt was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID\nvalues in quadratic time relative to the number of arcs. An attacker could\npossibly use this issue to cause applications decoding untrusted ASN.1 data\nto consume excessive CPU resources, resulting in a denial of service.\n(CVE-2026-59885)\n\nIt was discovered that pyasn1 incorrectly handled conversion of decoded\nREAL values to Python float types. An attacker could possibly use this\nissue to cause applications decoding untrusted ASN.1 data to consume\nexcessive CPU and memory resources, resulting in a denial of service.\n(CVE-2026-59886)","modified":"2026-09-02T02:41:28.700081773Z","published":"2026-09-01T16:20:26Z","related":["UBUNTU-CVE-2026-59884","UBUNTU-CVE-2026-59885","UBUNTU-CVE-2026-59886"],"upstream":["CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","UBUNTU-CVE-2026-59884","UBUNTU-CVE-2026-59885","UBUNTU-CVE-2026-59886"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8712-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-59884"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-59885"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-59886"}],"affected":[{"package":{"name":"pyasn1","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/pyasn1?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-1ubuntu0.3"}]}],"versions":["0.4.8-1","0.4.8-1ubuntu0.1","0.4.8-1ubuntu0.2"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"0.4.8-1ubuntu0.3","binary_name":"pypy-pyasn1"},{"binary_name":"python3-pyasn1","binary_version":"0.4.8-1ubuntu0.3"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:22.04:LTS","cves":[{"id":"CVE-2026-59884","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-59885","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-59886","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8712-1.json"}},{"package":{"name":"pyasn1","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/pyasn1?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-4ubuntu0.3"}]}],"versions":["0.4.8-4","0.4.8-4ubuntu0.1","0.4.8-4ubuntu0.2"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"0.4.8-4ubuntu0.3","binary_name":"python3-pyasn1"}]},"database_specific":{"cves_map":{"cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-59884"},{"id":"CVE-2026-59885","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-59886","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:24.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8712-1.json"}},{"package":{"name":"pyasn1","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/pyasn1?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-1ubuntu0.1"}]}],"versions":["0.6.1-1","0.6.1-1build1","0.6.2-1","0.6.3-1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-pyasn1","binary_version":"0.6.3-1ubuntu0.1"}],"availability":"No subscription required"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:26.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-59884"},{"id":"CVE-2026-59885","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-59886","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8712-1.json"}}],"schema_version":"1.9.0"}