CVE-2026-59884

Name of the Vulnerable Software and Affected Versions pyasn1 versions prior to 0.6.4

Description The BER decoder used by CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size. A crafted input can force the construction of an arbitrarily large integer, resulting in CPU cost that grows quadratically and triggering unhandled ValueError exceptions in Python 3.11+ error formatting paths. This affects any application decoding untrusted BER, CER, or DER input.

Recommendations Update to version 0.6.4.