CVE-2026-59885High· 7.5▾ Twilight

pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER (CVE-2026-59885)

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 14, 2026

Updated

Sep 21, 2026

CVSS

7.5

Vendor

Red Hat

Product

Red Hat OpenShift AI 3.4

CWE

CWE-1050, CWE-400, CWE-407

Depth score

41 · Moderate

EPSS

0.34% · p27

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 21.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 69 days

Jul 14, 2026Published
Disclosed via CSAF
Jul 21, 2026EPSS first tracked
0.3%
Sep 21, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-1050 CWE-400 CWE-407 #csaf #vex #red-hat #osv #pip #ghsa

Affected

exploit_intelligence
lightspeed_core
migration_toolkit_for_applications 8
migration_toolkit_for_containers
migration_toolkit_for_virtualization
openshift_lightspeed
openshift_service_mesh 3
ai_inference_server
ansible_automation_platform 2
ceph_storage 7
ceph_storage 8
ceph_storage 9
enterprise_linux 10
enterprise_linux 6
enterprise_linux 7
enterprise_linux 8
enterprise_linux 9
enterprise_linux_ai_rhel_ai 3
openshift_ai_rhoai
openshift_container_platform 4
openstack_platform 16.2
openstack_platform 17.1
openstack_platform 18.0
satellite 6
trusted_artifact_signer
service_telemetry_framework 1.5
ansible_automation_platform_2_5_for_rhel 8
ansible_automation_platform_2_5_for_rhel 9
ansible_automation_platform_2_6_for_rhel 9
ai_inference_server 3.3
enterprise_linux_ai 3.3
hardened_images
migration_toolkit_for_applications 8.2
openshift_ai 2.25
openshift_ai 3.4
quay 3.10
quay 3.12
quay 3.15
quay 3.16
quay 3.9

Patched in

ansible_automation_platform_2_5_for_rhel 8
ansible_automation_platform_2_5_for_rhel 9
ansible_automation_platform_2_6_for_rhel 9
ai_inference_server 3.3
enterprise_linux_ai 3.3
hardened_images
migration_toolkit_for_applications 8.2
openshift_ai 2.25
openshift_ai 3.4
quay 3.10
quay 3.12
quay 3.15
quay 3.16
quay 3.9

Full technical detail▾

Overview

A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One (ASN.1). The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload containing an OID with many arcs, leading to excessive CPU consumption and a denial of service (DoS) in applications that decode untrusted ASN.1 data. The corresponding encoders also exhibit this quadratic behavior when re-encoding attacker-supplied values.

Vendor advisories

RHSA-2026:50319 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-04 · advisory
RHSA-2026:50336 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-04 · advisory
RHSA-2026:59518 · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-08-25 · advisory
RHSA-2026:62336 · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-09-01 · advisory
RHSA-2026:62335 · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-09-01 · advisory
RHSA-2026:40236 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-15 · advisory
RHSA-2026:56347 · Red Hat · fixed in: Red Hat Migration Toolkit for Applications 8.2 · released 2026-08-18 · advisory
RHSA-2026:65126 · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · advisory
RHSA-2026:60520 · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · advisory
RHSA-2026:53520 · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-08-11 · advisory
RHSA-2026:52968 · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-08-10 · advisory
Red Hat VEX · Important · affected: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Migration Toolkit for Virtualization, OpenShift Lightspeed, … · no fix planned: Red Hat Enterprise Linux 6, Migration Toolkit for Virtualization, Red Hat AI Inference Server, Exploit Intelligence, … · updated 2026-09-21 · vex
RHSA-2026:48933 · Red Hat · fixed in: Red Hat Quay 3.15 · released 2026-07-30 · advisory

pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER — rated Important by Red Hat. Released 2026-07-14, updated 2026-09-21.

Affected:

Exploit Intelligence
Lightspeed Core
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Migration Toolkit for Virtualization
OpenShift Lightspeed
OpenShift Service Mesh 3
Red Hat AI Inference Server
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Container Platform 4
Red Hat OpenStack Platform 16.2
Red Hat OpenStack Platform 17.1
Red Hat OpenStack Platform 18.0
Red Hat Satellite 6
Red Hat Trusted Artifact Signer
Service Telemetry Framework 1.5

Fixed:

Red Hat Ansible Automation Platform 2.5 for RHEL 8
Red Hat Ansible Automation Platform 2.5 for RHEL 9
Red Hat Ansible Automation Platform 2.6 for RHEL 9
Red Hat AI Inference Server 3.3
Red Hat Enterprise Linux AI 3.3
Red Hat Hardened Images
Red Hat Migration Toolkit for Applications 8.2
Red Hat OpenShift AI 2.25
Red Hat OpenShift AI 3.4
Red Hat Quay 3.10
Red Hat Quay 3.12
Red Hat Quay 3.15
Red Hat Quay 3.16
Red Hat Quay 3.9

No fix planned:

Red Hat Enterprise Linux 6
Migration Toolkit for Virtualization
Red Hat AI Inference Server
Exploit Intelligence
Lightspeed Core
Migration Toolkit for Containers
OpenShift Service Mesh 3
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenStack Platform 16.2
Red Hat OpenStack Platform 17.1
Red Hat OpenStack Platform 18.0
Red Hat Satellite 6
Red Hat Trusted Artifact Signer
Migration Toolkit for Applications 8
OpenShift Lightspeed
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Container Platform 4
Service Telemetry Framework 1.5

Not affected:

Red Hat Ansible Automation Platform 2.6 for RHEL 10
Red Hat Ansible Automation Platform 2.5 for RHEL 8
Red Hat Ansible Automation Platform 2.5 for RHEL 9
Red Hat Ansible Automation Platform 2.6 for RHEL 9
Red Hat Enterprise Linux AI 3.3
Red Hat Migration Toolkit for Applications 8.2
Red Hat OpenShift AI 2.25
Red Hat OpenShift AI 3.4
Red Hat Quay 3.10
Red Hat Quay 3.12

Remediation

For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50319 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:50336 For more information visit https://access.redhat.com/errata/RHSA-2026:59518 https://access.redhat.com/errata/RHSA-2026:59518

Workarounds / mitigations:

Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.

Package advisory (CVE-2026-59885)

Affected packages:

pyasn1 < 0.6.4

Patched in:

pyasn1 0.6.4

Source: https://osv.dev/vulnerability/GHSA-8ppf-4f7h-5ppj

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#pip#ghsa

← Back to feed