CVE-2026-59885: pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
Impact The BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload (tens of kilobytes) containing an OID with many arcs consumes seconds of CPU per decode() call, allowing denial of service in any application that decodes untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos, etc.). The corresponding encoders have the same quadratic behavior, reachable when an application re-encodes previously decoded attacker-supplied values.
The arc-size limit introduced for CVE-2026-23490 bounds the byte length of an individual arc but not the number of arcs, so it does not mitigate this issue.
Affected components ObjectIdentifierPayloadDecoder and RelativeOIDPayloadDecoder in pyasn1/codec/ber/decoder.py; ObjectIdentifierEncoder and RelativeOIDEncoder in pyasn1/codec/ber/encoder.py. The CER and DER codecs inherit these and are equally affected.
Patches Fixed in pyasn1 0.6.4: arc accumulation in both decoders and encoders now runs in linear time.
Workarounds Limit the size of untrusted ASN.1 input before decoding.
Other sources
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.
— MITRE
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pyasn1to a version that resolves this vulnerability.Fixed in 0.6.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.4.8-3 - Upgrade
Upgrade
pyasn1to a version that resolves this vulnerability.Fixed in 0.6.4 - Compensating control
Limit the size of untrusted ASN.1 input before calling decode() to prevent CPU exhaustion from crafted OBJECT IDENTIFIER / RELATIVE-OID payloads (pyasn1/codec/ber/decoder.py: ObjectIdentifierPayloadDecoder and RelativeOIDPayloadDecoder).
- Compensating control
Limit the size of untrusted ASN.1 input before re-encoding attacker-supplied values using OBJECT IDENTIFIER / RELATIVE-OID encoders to avoid quadratic-time behavior (pyasn1/codec/ber/encoder.py: ObjectIdentifierEncoder and RelativeOIDEncoder).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59885?
The severity of CVE-2026-59885 is classified as high with a score of 7.5.
What does CVE-2026-59885 affect?
CVE-2026-59885 affects the pyasn1 library for Python, specifically its handling of OBJECT IDENTIFIER and RELATIVE-OID processing.
How do I fix CVE-2026-59885?
To fix CVE-2026-59885, upgrade the pyasn1 library to version 0.6.4 or later.
What type of vulnerability is CVE-2026-59885?
CVE-2026-59885 is a denial of service vulnerability caused by quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing.
What attacks can be performed using CVE-2026-59885?
An attacker can exploit CVE-2026-59885 to create crafted payloads that excessively consume CPU resources, leading to potential denial of service.