CVE-2026-59886 pyasn1 CVE debrief

Who should care

Developers and administrators using the pyasn1 library in their applications, especially those handling ASN.1 data, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The pyasn1 library for Python, prior to version 0.6.4, has a vulnerability in the univ.Real type conversion. When decoding untrusted ASN.1 data, the conversion of mantissa, base, and exponent values to a Python float using exact big-integer exponentiation can cause excessive CPU and memory consumption. This can lead to application hangs when printing, logging, or comparing decoded objects. The vulnerability is fixed in version 0.6.4. Developers and administrators using the pyasn1 library in their applications, especially those handling ASN.1 data, should be aware of this vulnerability and take steps to mitigate it.

Defensive priority

High

Recommended defensive actions

• Upgrade pyasn1 to version 0.6.4 or later
• Limit exposure to untrusted ASN.1 data
• Implement input validation and sanitization for ASN.1 data
• Monitor applications for excessive CPU and memory consumption
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-14T17:17:15.010Z and was last modified on 2026-07-21T14:38:13.080Z. The NVD entry is currently Analyzed. This issue is related to the pyasn1 library for Python, which is vulnerable to excessive CPU and memory consumption when decoding untrusted ASN.1 data. The vulnerability is caused by the univ.Real type converting its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. This can cause applications to hang when printing, logging, or comparing decoded objects. The CVE record was published on 2026-07-14T17:17:15.010Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.