MGASA-2026-0380 Updated python-pyasn1 packages fix security vulnerabilities

The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a 1 ...

Updated python-pyasn1 packages fix security vulnerabilities

The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a 1 ...

Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component uses pyasn1-0.6.3 which is vulnerable to CVE-2026-59884, CVE-2026-59885, CVE-2026-59886

Summary IBM Maximo Application Suite - Location Service for Esri Component uses pyasn1-0.6.3 which is vulnerable to CVE-2026-59884, CVE-2026-59885, CVE-2026-59886. This bulletin contains information regarding these vulnerabilities and their fixtures. Vulnerability Details CVEID:CVE-2026-59884...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple uncontrolled resource consumption vulnerabilities due to pyasn1

Summary pyasn1 is used by IBM Integrated Analytics System as a generic ASN.1 library for Python, providing encoding and decoding of ASN.1 data structures. Multiple vulnerabilities affect pyasn1 versions prior to 0.6.4. CVE-2026-59884 involves the BER decoder accumulating long-form tag continuatio...

Security Bulletin:Vulnerability in pyasn1 affects IBM Netezza Appliance

Summary The pyasn1 package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-59884, CVE-2026-59885, CVE-2026-59886 Vulnerability Details CVEID:CVE-2026-59884 DESCRIPTION: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder...

SUSE-SU-2026:23167-1 Security update for python-pyasn1

This update for python-pyasn1 fixes the following issues: - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service bsc1271465. -...

Important: python-pyasn1

Issue Overview: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily larg...

CVE-2026-63550 MZ Automation libiec61850 Out-of-bounds Read

The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session TCP port 102, the decoder may advance its internal read position incorrectly, leading to a he...

CVE-2026-63550

The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session TCP port 102, the decoder may advance its internal read position incorrectly, leading to a he...

CVE-2026-63550 MZ Automation libiec61850 Out-of-bounds Read

The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session TCP port 102, the decoder may advance its internal read position incorrectly, leading to a he...

CVE-2026-65421

CVE-2026-65421 affects the MMS BER decoder in the MMS/IEC 61850 stack (as noted in NVD and CVE lists). The flaw is an attacker-supplied length for fixed-width BER fields (boolean/integer) that is not validated, causing a read past the end of a heap buffer. This results in termination of the MMS s...

CVE-2026-65421: Out-of-bounds Read

The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...

CVE-2026-63550: Out-of-bounds Read

The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session TCP port 102, the decoder may advance its internal read position incorrectly, leading to a he...

SUSE-SU-2026:23006-1 Security update for python-pyasn1

This update for python-pyasn1 fixes the following issues: This update for python-pyasn1 fixes the following issues: - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID...

SUSE CVE-2026-64448

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

CVE-2026-64448

Summary (CVE-2026-64448): The Linux kernel fix addresses a SMB2 negotiation bug in CIFS/NTLM handling. A long-standing quirk in smb2_check_message() unconditionally granted a +1 length exemption for responses, even when a data area was present. This could cause the decoder to read past the receiv...

PT-2026-64669

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the SMB client. The smb2 check message function incorrectly applies a one-byte length exemption unconditionally, regardless of whether the command...

openSUSE 16 Security Update : python-pyasn1 (openSUSE-SU-2026:21392-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21392-1 advisory. - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. - CVE-2026-59885: quadratic complexity in...

GHSA-M4P7-R5RC-7G4J pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

Impact The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size...

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

Impact The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size...