{"id":"CVE-2026-59885","title":"pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885)","summary":"A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One (ASN.1). The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker cou…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-1050","CWE-400","CWE-407"],"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","affected":["exploit_intelligence","lightspeed_core","migration_toolkit_for_applications 8","migration_toolkit_for_containers","migration_toolkit_for_virtualization","openshift_lightspeed","openshift_service_mesh 3","ai_inference_server","ansible_automation_platform 2","ceph_storage 7","ceph_storage 8","ceph_storage 9","enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_container_platform 4","openstack_platform 16.2","openstack_platform 17.1","openstack_platform 18.0","satellite 6","trusted_artifact_signer","service_telemetry_framework 1.5","ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","ai_inference_server 3.3","enterprise_linux_ai 3.3","hardened_images","migration_toolkit_for_applications 8.2","openshift_ai 2.25","openshift_ai 3.4","quay 3.10","quay 3.12","quay 3.15","quay 3.16","quay 3.9"],"patched":["ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","ai_inference_server 3.3","enterprise_linux_ai 3.3","hardened_images","migration_toolkit_for_applications 8.2","openshift_ai 2.25","openshift_ai 3.4","quay 3.10","quay 3.12","quay 3.15","quay 3.16","quay 3.9"],"published":"2026-07-14","updated":"2026-09-21","sourceUpdated":"2026-09-21T10:33:57+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59885.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59885.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59885"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500380"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59885"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59885"},{"url":"https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9"},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj"},{"url":"https://access.redhat.com/errata/RHSA-2026:50319"},{"url":"https://access.redhat.com/errata/RHSA-2026:50336"},{"url":"https://access.redhat.com/errata/RHSA-2026:59518"},{"url":"https://access.redhat.com/errata/RHSA-2026:62336"},{"url":"https://access.redhat.com/errata/RHSA-2026:62335"},{"url":"https://access.redhat.com/errata/RHSA-2026:40236"},{"url":"https://access.redhat.com/errata/RHSA-2026:56347"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"url":"https://access.redhat.com/errata/RHSA-2026:53520"},{"url":"https://access.redhat.com/errata/RHSA-2026:52968"},{"url":"https://access.redhat.com/errata/RHSA-2026:48933"},{"url":"https://access.redhat.com/errata/RHSA-2026:69255"},{"url":"https://access.redhat.com/errata/RHSA-2026:50931"},{"url":"https://github.com/pyasn1/pyasn1"},{"url":"https://github.com/advisories/GHSA-8ppf-4f7h-5ppj"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa"],"epss":0.00335,"epssPercentile":0.26857,"aliases":["GHSA-8ppf-4f7h-5ppj","PYSEC-2026-3456"],"ecosystem":"pip","ingestedAt":"2026-07-21T19:53:40.111Z","slug":"CVE-2026-59885","body":"## Overview\n\nA flaw was found in pyasn1, a Python library for Abstract Syntax Notation One (ASN.1). The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload containing an OID with many arcs, leading to excessive CPU consumption and a denial of service (DoS) in applications that decode untrusted ASN.1 data. The corresponding encoders also exhibit this quadratic behavior when re-encoding attacker-supplied values.\n\n## Vendor advisories\n\n- **RHSA-2026:50319** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50319)\n- **RHSA-2026:50336** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50336)\n- **RHSA-2026:59518** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59518)\n- **RHSA-2026:62336** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62336)\n- **RHSA-2026:62335** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62335)\n- **RHSA-2026:40236** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:40236)\n- **RHSA-2026:56347** · Red Hat · fixed in: Red Hat Migration Toolkit for Applications 8.2 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56347)\n- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)\n- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)\n- **RHSA-2026:53520** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-08-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:53520)\n- **RHSA-2026:52968** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52968)\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Migration Toolkit for Virtualization, OpenShift Lightspeed, … · no fix planned: Red Hat Enterprise Linux 6, Migration Toolkit for Virtualization, Red Hat AI Inference Server, Exploit Intelligence, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59885.json)\n- **RHSA-2026:48933** · Red Hat · fixed in: Red Hat Quay 3.15 · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48933)\n\n**pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER** — rated Important by Red Hat. Released 2026-07-14, updated 2026-09-21.\n\nAffected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Migration Toolkit for Virtualization\n- OpenShift Lightspeed\n- OpenShift Service Mesh 3\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n- Red Hat OpenStack Platform 18.0\n- Red Hat Satellite 6\n- Red Hat Trusted Artifact Signer\n- Service Telemetry Framework 1.5\n\nFixed:\n\n- Red Hat Ansible Automation Platform 2.5 for RHEL 8\n- Red Hat Ansible Automation Platform 2.5 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6 for RHEL 9\n- Red Hat AI Inference Server 3.3\n- Red Hat Enterprise Linux AI 3.3\n- Red Hat Hardened Images\n- Red Hat Migration Toolkit for Applications 8.2\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.4\n- Red Hat Quay 3.10\n- Red Hat Quay 3.12\n- Red Hat Quay 3.15\n- Red Hat Quay 3.16\n- Red Hat Quay 3.9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Migration Toolkit for Virtualization\n- Red Hat AI Inference Server\n- Exploit Intelligence\n- Lightspeed Core\n- Migration Toolkit for Containers\n- OpenShift Service Mesh 3\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenStack Platform 17.1\n- Red Hat OpenStack Platform 18.0\n- Red Hat Satellite 6\n- Red Hat Trusted Artifact Signer\n- Migration Toolkit for Applications 8\n- OpenShift Lightspeed\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Service Telemetry Framework 1.5\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2.6 for RHEL 10\n- Red Hat Ansible Automation Platform 2.5 for RHEL 8\n- Red Hat Ansible Automation Platform 2.5 for RHEL 9\n- Red Hat Ansible Automation Platform 2.6 for RHEL 9\n- Red Hat Enterprise Linux AI 3.3\n- Red Hat Migration Toolkit for Applications 8.2\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.4\n- Red Hat Quay 3.10\n- Red Hat Quay 3.12\n\n## Remediation\n\nFor details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50319\nFor details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50336\nFor more information visit https://access.redhat.com/errata/RHSA-2026:59518 https://access.redhat.com/errata/RHSA-2026:59518\n\nWorkarounds / mitigations:\n\n- Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.\n\n## Package advisory (CVE-2026-59885)\n\nAffected packages:\n\n- `pyasn1 < 0.6.4`\n\nPatched in:\n\n- `pyasn1 0.6.4`\n\nSource: https://osv.dev/vulnerability/GHSA-8ppf-4f7h-5ppj","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}