{
  "cveId": "CVE-2026-59885",
  "url": "https://patchblox.com/security/cve/CVE-2026-59885",
  "summary": "CVE-2026-59885 is fixed in 6 products on 1 platform, first by pypy-pyasn1 0.4.8-1ubuntu0.3, released July 14, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service",
  "description": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.",
  "published": "2026-07-14T10:17:00Z",
  "severity": "Important",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "Uncontrolled Resource Consumption",
  "epss": 0.00616,
  "epssPercentile": 0.498,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59885",
  "fixes": [
    {
      "platform": "linux",
      "product": "pyasn1",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "0.4.8-3\u002Bdeb12u3",
      "fix": "DEBIAN-CVE-2026-59885",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-59885",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "pyasn1",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "0.6.1-1\u002Bdeb13u3",
      "fix": "DEBIAN-CVE-2026-59885",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-59885",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "pyasn1",
      "release": "Debian 14",
      "fixedVersion": "0.6.4-1",
      "fix": "DEBIAN-CVE-2026-59885",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-59885",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "pypy-pyasn1",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "0.4.8-1ubuntu0.3",
      "fix": "pypy-pyasn1 0.4.8-1ubuntu0.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-pypy-pyasn1-0.4.8-1ubuntu0.3",
      "released": "2026-07-14T10:17:00Z"
    },
    {
      "platform": "linux",
      "product": "python-pyasn1",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.6.1-160000.5.1",
      "fix": "OPENSUSE-SU-2026:21392-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21392-1",
      "released": "2026-07-20T12:16:10Z"
    },
    {
      "platform": "linux",
      "product": "python-pyasn1",
      "release": "sles 15.6",
      "fixedVersion": "0.5.0-150400.12.16.1",
      "fix": "SUSE-SU-2026:3238-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3238-1",
      "released": "2026-07-24T12:56:30Z"
    },
    {
      "platform": "linux",
      "product": "python-pyasn1",
      "release": "sles 15.7",
      "fixedVersion": "0.5.0-150400.12.16.1",
      "fix": "SUSE-SU-2026:3238-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3238-1",
      "released": "2026-07-24T12:56:30Z"
    },
    {
      "platform": "linux",
      "product": "python-pyasn1",
      "release": "sles 16.0",
      "fixedVersion": "0.6.1-160000.5.1",
      "fix": "SUSE-SU-2026:22830-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22830-1",
      "released": "2026-07-20T12:15:58Z"
    },
    {
      "platform": "linux",
      "product": "python-pyasn1-doc",
      "release": "amzn 2023",
      "fixedVersion": "0.4.8-4.amzn2023.0.5",
      "fix": "ALAS2023-2026-2000",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2000",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyasn1",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "0.4.8-1ubuntu0.3",
      "fix": "python3-pyasn1 0.4.8-1ubuntu0.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-pyasn1-0.4.8-1ubuntu0.3",
      "released": "2026-07-14T10:17:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyasn1",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "0.4.8-4ubuntu0.3",
      "fix": "python3-pyasn1 0.4.8-4ubuntu0.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-pyasn1-0.4.8-4ubuntu0.3",
      "released": "2026-07-14T10:17:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyasn1",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "0.6.3-1ubuntu0.1",
      "fix": "python3-pyasn1 0.6.3-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-python3-pyasn1-0.6.3-1ubuntu0.1",
      "released": "2026-07-14T10:17:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyasn1",
      "release": "amzn 2023",
      "fixedVersion": "0.4.8-4.amzn2023.0.5",
      "fix": "ALAS2023-2026-2000",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2000",
      "released": "2026-08-03T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-pyasn1-modules",
      "release": "amzn 2023",
      "fixedVersion": "0.4.8-4.amzn2023.0.5",
      "fix": "ALAS2023-2026-2000",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2000",
      "released": "2026-08-03T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}