PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59886 pyasn1 CVE debrief

The pyasn1 library for Python, prior to version 0.6.4, is vulnerable to excessive CPU and memory consumption when decoding untrusted ASN.1 data. The univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation, which can cause applications to hang when printing, logging, or comparing decoded objects. This issue is fixed in version 0.6.4. Developers and administrators using the pyasn1 library in their applications, especially those handling ASN.1 data, should be aware of this vulnerability and take steps to mitigate it.

Vendor
pyasn1
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-21
Advisory published
2026-07-14
Advisory updated
2026-07-21

Who should care

Developers and administrators using the pyasn1 library in their applications, especially those handling ASN.1 data, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The pyasn1 library for Python, prior to version 0.6.4, has a vulnerability in the univ.Real type conversion. When decoding untrusted ASN.1 data, the conversion of mantissa, base, and exponent values to a Python float using exact big-integer exponentiation can cause excessive CPU and memory consumption. This can lead to application hangs when printing, logging, or comparing decoded objects. The vulnerability is fixed in version 0.6.4. Developers and administrators using the pyasn1 library in their applications, especially those handling ASN.1 data, should be aware of this vulnerability and take steps to mitigate it.

Defensive priority

High

Recommended defensive actions

  • Upgrade pyasn1 to version 0.6.4 or later
  • Limit exposure to untrusted ASN.1 data
  • Implement input validation and sanitization for ASN.1 data
  • Monitor applications for excessive CPU and memory consumption
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-14T17:17:15.010Z and was last modified on 2026-07-21T14:38:13.080Z. The NVD entry is currently Analyzed. This issue is related to the pyasn1 library for Python, which is vulnerable to excessive CPU and memory consumption when decoding untrusted ASN.1 data. The vulnerability is caused by the univ.Real type converting its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. This can cause applications to hang when printing, logging, or comparing decoded objects. The CVE record was published on 2026-07-14T17:17:15.010Z and has not been modified since then.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T17:17:15.010Z and has not been modified since then. The NVD entry is currently Analyzed.