{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/pyasn1--0.6.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-59886"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pyasn1 \u003c= 0.6.3"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","python","library"],"_cs_type":"advisory","_cs_vendors":["pyasn1"],"content_html":"\u003cp\u003eA critical vulnerability (CVE-2026-59886) has been identified in the \u003ccode\u003epyasn1\u003c/code\u003e Python library, specifically affecting versions up to 0.6.3. This flaw, classified as uncontrolled resource consumption, arises when the \u003ccode\u003euniv.Real\u003c/code\u003e type converts specially crafted BER/CER/DER-encoded ASN.1 REAL values to Python floats. An attacker can craft a REAL value with a large exponent, which, upon conversion (e.g., via printing, logging, comparison, or arithmetic operations), attempts to materialize an astronomically large integer. This computationally intensive process consumes excessive CPU and memory, leading to a denial of service in applications that decode untrusted ASN.1 data and subsequently operate on these decoded objects. The issue is purely a DoS vector and does not involve remote code execution or data exfiltration. The vulnerability is fixed in \u003ccode\u003epyasn1\u003c/code\u003e version 0.6.4, released to address this resource exhaustion attack.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious BER/CER/DER-encoded ASN.1 REAL value containing a very large exponent.\u003c/li\u003e\n\u003cli\u003eA vulnerable application, using \u003ccode\u003epyasn1\u003c/code\u003e versions \u0026lt;= 0.6.3, receives and decodes untrusted ASN.1 data.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epyasn1.codec.ber\u003c/code\u003e, \u003ccode\u003ecer\u003c/code\u003e, or \u003ccode\u003eder\u003c/code\u003e decoders process the input, creating a \u003ccode\u003epyasn1.type.univ.Real\u003c/code\u003e object.\u003c/li\u003e\n\u003cli\u003eThe application then performs an operation that implicitly or explicitly triggers a float conversion on the crafted \u003ccode\u003euniv.Real\u003c/code\u003e object (e.g., \u003ccode\u003eprettyPrint()\u003c/code\u003e, \u003ccode\u003estr()\u003c/code\u003e, comparison, arithmetic operation, or \u003ccode\u003efloat()\u003c/code\u003e call).\u003c/li\u003e\n\u003cli\u003eDuring this conversion, \u003ccode\u003epyasn1\u003c/code\u003e attempts exact big-integer exponentiation based on the large exponent in the REAL value.\u003c/li\u003e\n\u003cli\u003eThis computation requires materializing an extremely large intermediate integer, leading to a rapid and uncontrolled consumption of system CPU and memory resources.\u003c/li\u003e\n\u003cli\u003eThe application becomes unresponsive or crashes due to resource exhaustion, resulting in a denial of service for legitimate users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-59886 leads to a denial of service (DoS) for applications processing untrusted ASN.1 REAL values using \u003ccode\u003epyasn1\u003c/code\u003e library versions 0.6.3 or earlier. The vulnerability causes the application to consume excessive CPU and memory, often leading to unresponsiveness or a crash. Any operation that converts the \u003ccode\u003epyasn1.type.univ.Real\u003c/code\u003e object to a Python float, such as printing, logging, comparing, or performing arithmetic, can trigger this resource exhaustion. While no specific victim counts or sectors are mentioned, any Python application that handles untrusted ASN.1 REAL data via \u003ccode\u003epyasn1\u003c/code\u003e is at risk of being rendered unavailable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-59886 by upgrading the \u003ccode\u003epyasn1\u003c/code\u003e library to version 0.6.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate patching of \u003ccode\u003epyasn1\u003c/code\u003e is not feasible, implement workarounds to avoid converting, printing, or comparing \u003ccode\u003epyasn1.type.univ.Real\u003c/code\u003e objects from untrusted sources. Instead, inspect the raw (mantissa, base, exponent) tuple directly.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T19:15:06Z","date_published":"2026-07-21T19:15:06Z","id":"https://feed.craftedsignal.io/briefs/2026-07-pyasn1-uncontrolled-resource-consumption/","summary":"The pyasn1 library is vulnerable to uncontrolled resource consumption (excessive CPU and memory) when converting BER/CER/DER-encoded REAL values to Python floats, which can lead to a denial of service (DoS) in applications that decode untrusted ASN.1 data and then perform operations like printing, logging, comparing, or arithmetic on the decoded `univ.Real` objects.","title":"pyasn1 Uncontrolled Resource Consumption (CVE-2026-59886)","url":"https://feed.craftedsignal.io/briefs/2026-07-pyasn1-uncontrolled-resource-consumption/"}],"language":"en","title":"CraftedSignal Threat Feed - Pyasn1 \u003c= 0.6.3","version":"https://jsonfeed.org/version/1.1"}