{
  "cveId": "CVE-2026-59884",
  "url": "https://patchblox.com/security/cve/CVE-2026-59884",
  "summary": "CVE-2026-59884 is fixed in 6 products on 1 platform, first by pypy-pyasn1 0.4.8-1ubuntu0.3, released July 14, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs",
  "description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11\u002B error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.",
  "published": "2026-07-14T10:17:00Z",
  "severity": "Important",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "Uncontrolled Resource Consumption",
  "epss": 0.00616,
  "epssPercentile": 0.49799,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59884",
  "fixes": [
    {
      "platform": "linux",
      "product": "pyasn1",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "0.4.8-3\u002Bdeb12u3",
      "fix": "DEBIAN-CVE-2026-59884",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-59884",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "pyasn1",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "0.6.1-1\u002Bdeb13u3",
      "fix": "DEBIAN-CVE-2026-59884",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-59884",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "pyasn1",
      "release": "Debian 14",
      "fixedVersion": "0.6.4-1",
      "fix": "DEBIAN-CVE-2026-59884",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-59884",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "pypy-pyasn1",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "0.4.8-1ubuntu0.3",
      "fix": "pypy-pyasn1 0.4.8-1ubuntu0.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-pypy-pyasn1-0.4.8-1ubuntu0.3",
      "released": "2026-07-14T10:17:00Z"
    },
    {
      "platform": "linux",
      "product": "python-pyasn1",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.6.1-160000.5.1",
      "fix": "OPENSUSE-SU-2026:21392-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21392-1",
      "released": "2026-07-20T12:16:10Z"
    },
    {
      "platform": "linux",
      "product": "python-pyasn1",
      "release": "sles 15.6",
      "fixedVersion": "0.5.0-150400.12.16.1",
      "fix": "SUSE-SU-2026:3238-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3238-1",
      "released": "2026-07-24T12:56:30Z"
    },
    {
      "platform": "linux",
      "product": "python-pyasn1",
      "release": "sles 15.7",
      "fixedVersion": "0.5.0-150400.12.16.1",
      "fix": "SUSE-SU-2026:3238-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3238-1",
      "released": "2026-07-24T12:56:30Z"
    },
    {
      "platform": "linux",
      "product": "python-pyasn1",
      "release": "sles 16.0",
      "fixedVersion": "0.6.1-160000.5.1",
      "fix": "SUSE-SU-2026:22830-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22830-1",
      "released": "2026-07-20T12:15:58Z"
    },
    {
      "platform": "linux",
      "product": "python-pyasn1-doc",
      "release": "amzn 2023",
      "fixedVersion": "0.4.8-4.amzn2023.0.5",
      "fix": "ALAS2023-2026-2000",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2000",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyasn1",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "0.4.8-1ubuntu0.3",
      "fix": "python3-pyasn1 0.4.8-1ubuntu0.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-pyasn1-0.4.8-1ubuntu0.3",
      "released": "2026-07-14T10:17:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyasn1",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "0.4.8-4ubuntu0.3",
      "fix": "python3-pyasn1 0.4.8-4ubuntu0.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-pyasn1-0.4.8-4ubuntu0.3",
      "released": "2026-07-14T10:17:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyasn1",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "0.6.3-1ubuntu0.1",
      "fix": "python3-pyasn1 0.6.3-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-python3-pyasn1-0.6.3-1ubuntu0.1",
      "released": "2026-07-14T10:17:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyasn1",
      "release": "amzn 2023",
      "fixedVersion": "0.4.8-4.amzn2023.0.5",
      "fix": "ALAS2023-2026-2000",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2000",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyasn1-modules",
      "release": "amzn 2023",
      "fixedVersion": "0.4.8-4.amzn2023.0.5",
      "fix": "ALAS2023-2026-2000",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2000",
      "released": "2026-08-03T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}