CVE-2026-59885

Name of the Vulnerable Software and Affected Versions pyasn1 versions prior to 0.6.4

Description The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A crafted payload containing an OID with many arcs can cause excessive CPU consumption during the decode() call, leading to a denial of service for applications processing untrusted ASN.1 data. Similarly, the encoders exhibit the same quadratic behavior when re-encoding previously decoded attacker-supplied values.

Recommendations Update pyasn1 to version 0.6.4.