CVE-2026-59886High· 7.5▾ Twilight

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886)

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 14, 2026

Updated

Sep 21, 2026

CVSS

7.5

Vendor

Red Hat

Product

Red Hat Enterprise Linux AppStream EUS (v.9.6)

CWE

CWE-770, CWE-400

Depth score

41 · Moderate

EPSS

0.34% · p27

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 21.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 69 days

Jul 14, 2026Published
Disclosed via CSAF
Jul 21, 2026EPSS first tracked
0.3%
Sep 21, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-770 CWE-400 #csaf #vex #red-hat #osv #pip #ghsa

Affected

Patched in

enterprise_linux_server_v_7_els
enterprise_linux_server_highavailability_v_7_els
enterprise_linux_server_resilientstorage_v_7_els
enterprise_linux_server_for_sap_els_v_7
enterprise_linux_server_for_saphana_els_v_7
ansible_automation_platform_2_5_for_rhel 8
ansible_automation_platform_2_5_for_rhel 9
ansible_automation_platform_2_6_for_rhel 9
enterprise_linux_appstream_eus_v_10_0
enterprise_linux_appstream_v_10
enterprise_linux_appstream_v_8
enterprise_linux_appstream_aus_v_8_4
enterprise_linux_appstream_eus_extension_v_8_4
enterprise_linux_appstream_aus_v_8_6
enterprise_linux_appstream_eus_extension_v_8_6
enterprise_linux_appstream_e4s_v_8_8
enterprise_linux_appstream_tus_v_8_8
enterprise_linux_appstream_e4s_v_9_2
enterprise_linux_appstream_e4s_v_9_4
enterprise_linux_appstream_eus_v_9_6
enterprise_linux_appstream_v_9
enterprise_linux_highavailability_v_8
enterprise_linux_high_availability_aus_v_8_4
enterprise_linux_highavailability_eus_extension_v_8_4
enterprise_linux_high_availability_eus_extension_v_8_6
enterprise_linux_high_availability_e4s_v_8_8
enterprise_linux_high_availability_tus_v_8_8
enterprise_linux_high_availability_e4s_v_9_2
enterprise_linux_high_availability_e4s_v_9_4
ai_inference_server 3.3
ansible_automation_platform 2.5
ansible_automation_platform 2.6
ansible_automation_platform 2.7
enterprise_linux_ai 3.3
hardened_images
migration_toolkit_for_applications 8.2
openshift_ai 3.4
quay 3.10
quay 3.12
quay 3.15

Full technical detail▾

Overview

Vendor advisories

RHSA-2026:59240 · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-08-25 · advisory
RHSA-2026:59329 · Red Hat · fixed in: Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS), Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS), Red Hat Enterprise Linux Server for SAP ELS (v. 7), Red Hat Enterprise Linux Server for SAPHANA ELS (v. 7) · released 2026-08-25 · advisory
RHSA-2026:59135 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-24 · advisory
RHSA-2026:50319 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-04 · advisory
RHSA-2026:59136 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-24 · advisory
RHSA-2026:50336 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-04 · advisory
RHSA-2026:59238 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-08-25 · advisory
RHSA-2026:59243 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-08-25 · advisory
RHSA-2026:53363 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2026-08-11 · advisory
RHSA-2026:59241 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-08-25 · advisory
RHSA-2026:58821 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4), Red Hat Enterprise Linux High Availability AUS (v.8.4), Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) · released 2026-08-24 · advisory
Red Hat VEX · Important · affected: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Migration Toolkit for Virtualization, OpenShift Lightspeed, … · no fix planned: Red Hat Enterprise Linux 6, Exploit Intelligence, Migration Toolkit for Containers, Migration Toolkit for Virtualization, … · updated 2026-09-21 · vex

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values — rated Important by Red Hat. Released 2026-07-14, updated 2026-09-21.

Affected:

Exploit Intelligence
Lightspeed Core
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Migration Toolkit for Virtualization
OpenShift Lightspeed
Red Hat AI Inference Server
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Container Platform 4
Red Hat OpenStack Platform 16.2
Red Hat OpenStack Platform 17.1
Red Hat OpenStack Platform 18.0
Red Hat Satellite 6
Service Telemetry Framework 1.5

Fixed:

Red Hat Enterprise Linux Server (v. 7 ELS)
Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS)
Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS)
Red Hat Enterprise Linux Server for SAP ELS (v. 7)
Red Hat Enterprise Linux Server for SAPHANA ELS (v. 7)
Red Hat Ansible Automation Platform 2.5 for RHEL 8
Red Hat Ansible Automation Platform 2.5 for RHEL 9
Red Hat Ansible Automation Platform 2.6 for RHEL 9
Red Hat Enterprise Linux AppStream EUS (v. 10.0)
Red Hat Enterprise Linux AppStream (v. 10)
Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Enterprise Linux AppStream AUS (v.8.4)
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
Red Hat Enterprise Linux AppStream AUS (v.8.6)
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
Red Hat Enterprise Linux AppStream E4S (v.8.8)
Red Hat Enterprise Linux AppStream TUS (v.8.8)
Red Hat Enterprise Linux AppStream E4S (v.9.2)
Red Hat Enterprise Linux AppStream E4S (v.9.4)
Red Hat Enterprise Linux AppStream EUS (v.9.6)
Red Hat Enterprise Linux AppStream (v. 9)
Red Hat Enterprise Linux HighAvailability (v. 8)
Red Hat Enterprise Linux High Availability AUS (v.8.4)
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)
Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6)
Red Hat Enterprise Linux High Availability E4S (v.8.8)
Red Hat Enterprise Linux High Availability TUS (v.8.8)
Red Hat Enterprise Linux High Availability E4S (v.9.2)
Red Hat Enterprise Linux High Availability E4S (v.9.4)
Red Hat AI Inference Server 3.3
Red Hat Ansible Automation Platform 2.5
Red Hat Ansible Automation Platform 2.6
Red Hat Ansible Automation Platform 2.7
Red Hat Enterprise Linux AI 3.3
Red Hat Hardened Images
Red Hat Migration Toolkit for Applications 8.2
Red Hat OpenShift AI 3.4
Red Hat Quay 3.10
Red Hat Quay 3.12
Red Hat Quay 3.15

No fix planned:

Red Hat Enterprise Linux 6
Exploit Intelligence
Migration Toolkit for Containers
Migration Toolkit for Virtualization
Red Hat AI Inference Server
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Lightspeed Core
Migration Toolkit for Applications 8
OpenShift Lightspeed
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Container Platform 4
Red Hat OpenStack Platform 16.2
Red Hat OpenStack Platform 17.1
Red Hat OpenStack Platform 18.0
Red Hat Satellite 6
Service Telemetry Framework 1.5

Not affected:

Red Hat Ansible Automation Platform 2.6 for RHEL 10
Red Hat Ansible Automation Platform 2.5 for RHEL 8
Red Hat Ansible Automation Platform 2.5 for RHEL 9
Red Hat Ansible Automation Platform 2.6 for RHEL 9
Red Hat Ansible Automation Platform 2.5
Red Hat Ansible Automation Platform 2.6
Red Hat Ansible Automation Platform 2.7
Red Hat Enterprise Linux AI 3.3
Red Hat Migration Toolkit for Applications 8.2
Red Hat OpenShift AI 3.4

Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:59240 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:59329 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:59135

Workarounds / mitigations:

When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion.

Package advisory (CVE-2026-59886)

Affected packages:

pyasn1 < 0.6.4

Patched in:

pyasn1 0.6.4

Source: https://osv.dev/vulnerability/GHSA-hm4w-wwcw-mr6r

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#pip#ghsa

← Back to feed