CVE-2026-59884High· 7.5▾ Twilightpyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
Last analysed / modified upstream
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
pyasn1.codec.ber.decoder — decode() and StreamingDecoderpyasn1.codec.cer.decoder and pyasn1.codec.der.decoder, which inherit
the same tag parsingpyasn1.type.tag — Tag/TagSet reprs could raise ValueError when
rendering oversized tag IDs (reachable through decoder error paths)The encoders and the pyasn1.codec.native codec are not affected.
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Bound the size of untrusted input passed to decode() before calling it.
pyasn1 < 0.6.4Upgrade to a patched release:
pyasn1 0.6.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-30922High· 7.5pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
CVE-2026-23490High· 7.5pyasn1 is a generic ASN.1 library for Python
CVE-2026-33625High· 8.8LMDeploy is a toolkit for compressing, deploying, and serving large language models
CVE-2025-69534High· 7.5Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing
CVE-2020-3563High· 8.6A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device
CVE-2020-3554High· 7.5A vulnerability in the TCP packet processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conditi…