pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER

A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One ASN.1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload...

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption,...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses...

OESA-2026-3198 python-pyasn1 security update

Abstract Syntax Notation One ASN.1 is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python. Security Fixes: pyasn1 is a...

SUSE-SU-2026:23006-1 Security update for python-pyasn1

This update for python-pyasn1 fixes the following issues: This update for python-pyasn1 fixes the following issues: - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID...

Denial Of Service (DoS)

pyasn1 is vulnerable to Denial Of Service DoS. The vulnerability is due to the BER decoder parsing long-form tags without limiting the tag identifier size, which allows an attacker to supply crafted ASN.1 input that causes excessive CPU consumption or triggers unhandled exceptions, resulting in a...

SUSE-SU-2026:3238-1 Security update for python-pyasn1

This update for python-pyasn1 fixes the following issues: - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service bsc1271465. -...

CVE-2026-59884 affecting package python-pyasn1 for versions less than 0.4.8-3

CVE-2026-59884 affecting package python-pyasn1 for versions less than 0.4.8-3. A patched version of the package is available...

CVE-2026-59886 affecting package python-pyasn1 for versions less than 0.4.8-3

CVE-2026-59886 affecting package python-pyasn1 for versions less than 0.4.8-3. A patched version of the package is available...

CVE-2026-59885 affecting package python-pyasn1 for versions less than 0.4.8-3

CVE-2026-59885 affecting package python-pyasn1 for versions less than 0.4.8-3. A patched version of the package is available...

EUVD-2026-43738

pyasn1: Uncontrolled resource consumption when converting decoded REAL values...

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

Impact The univ.Real type converted its mantissa, base, exponent value to a Python float using exact big-integer exponentiation. A BER/CER/DER-encoded REAL value only a few bytes long can carry a very large exponent, causing this computation to attempt to materialize an astronomically large...

GHSA-HM4W-WWCW-MR6R pyasn1: Uncontrolled resource consumption when converting decoded REAL values

Impact The univ.Real type converted its mantissa, base, exponent value to a Python float using exact big-integer exponentiation. A BER/CER/DER-encoded REAL value only a few bytes long can carry a very large exponent, causing this computation to attempt to materialize an astronomically large...

EUVD-2026-43955

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service...

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

Impact The BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload tens of kilobytes containing an OID with many arcs consumes seconds of CPU per decode call, allowing denial of service in any application tha...

GHSA-8PPF-4F7H-5PPJ pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

Impact The BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload tens of kilobytes containing an OID with many arcs consumes seconds of CPU per decode call, allowing denial of service in any application tha...

EUVD-2026-43956

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs...

GHSA-M4P7-R5RC-7G4J pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

Impact The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size...

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

Impact The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size...

CVE-2026-59885

A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One ASN.1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload...