Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M
CVE-2026-59886pyasn1: Uncontrolled resource consumption when converting decoded REAL values
High 7.5
In plain English
A high-severity uncontrolled resource consumption in pyasn1 from pyasn1. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 61.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | fence-agents-aliyun | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-aliyun | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-all | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-all | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-amt-ws | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-amt-ws | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-apc | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-apc | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-apc-snmp | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-apc-snmp | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-aws | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-aws | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-azure-arm | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-azure-arm | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-bladecenter | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-bladecenter | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-brocade | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-brocade | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-cisco-mds | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-cisco-mds | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-cisco-ucs | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-cisco-ucs | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-common | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-common | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-compute | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-compute | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-drac5 | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-drac5 | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-eaton-snmp | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-eaton-snmp | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-emerson | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-emerson | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-eps | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-eps | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-gce | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-gce | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-heuristics-ping | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-heuristics-ping | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-hpblade | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-hpblade | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-ibm-powervs | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-ibm-powervs | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-ibm-vpc | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-ibm-vpc | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-ibmblade | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-ibmblade | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-ifmib | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-ifmib | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-ilo-moonshot | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-ilo-moonshot | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-ilo-mp | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-ilo-mp | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-ilo-ssh | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-ilo-ssh | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-ilo2 | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-ilo2 | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-intelmodular | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-intelmodular | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-ipdu | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-ipdu | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-ipmilan | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-ipmilan | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-kdump | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-kdump | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-kubevirt | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-kubevirt | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-lpar | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-lpar | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-mpath | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-mpath | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-nutanix-ahv | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-nutanix-ahv | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-openstack | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-openstack | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-redfish | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-redfish | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-rhevm | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-rhevm | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-rsa | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-rsa | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-rsb | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-rsb | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-sbd | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-sbd | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-scsi | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-scsi | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-virsh | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-virsh | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-vmware-rest | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-vmware-rest | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-vmware-soap | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-vmware-soap | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-wti | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-wti | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:8 | fence-agents-zvm | 4.2.1-129.el8_10.29 | ALSA-2026:53363 |
| AlmaLinux:9 | fence-agents-zvm | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:9 | fence-virt | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:9 | fence-virtd | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:9 | fence-virtd-cpg | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:9 | fence-virtd-libvirt | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:9 | fence-virtd-multicast | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:9 | fence-virtd-serial | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:9 | fence-virtd-tcp | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:9 | ha-cloud-support | 4.10.0-110.el9_8.6 | ALSA-2026:53365 |
| AlmaLinux:10 | python3-pyasn1 | 0.6.2-1.el10_2.1 | ALSA-2026:59243 |
| AlmaLinux:8 | python3-pyasn1 | 0.3.7-6.el8_10.2 | ALSA-2026:59241 |
| AlmaLinux:9 | python3-pyasn1 | 0.4.8-7.el9_8.1 | ALSA-2026:59242 |
| AlmaLinux:10 | python3-pyasn1-modules | 0.6.2-1.el10_2.1 | ALSA-2026:59243 |
| AlmaLinux:8 | python3-pyasn1-modules | 0.3.7-6.el8_10.2 | ALSA-2026:59241 |
| AlmaLinux:9 | python3-pyasn1-modules | 0.4.8-7.el9_8.1 | ALSA-2026:59242 |
| AlmaLinux:8 | resource-agents | 4.9.0-54.el8_10.37.alma.1 | ALSA-2026:53364 |
| AlmaLinux:8 | resource-agents-aliyun | 4.9.0-54.el8_10.37.alma.1 | ALSA-2026:53364 |
| AlmaLinux:8 | resource-agents-gcp | 4.9.0-54.el8_10.37.alma.1 | ALSA-2026:53364 |
| AlmaLinux:8 | resource-agents-paf | 4.9.0-54.el8_10.37.alma.1 | ALSA-2026:53364 |
| Debian:12 | pyasn1 | 0.4.8-3+deb12u3 | DEBIAN-CVE-2026-59886 |
| Debian:13 | pyasn1 | 0.6.1-1+deb13u3 | DEBIAN-CVE-2026-59886 |
| Debian:14 | pyasn1 | 0.6.4-1 | DEBIAN-CVE-2026-59886 |
| PyPI | pyasn1 | 0.6.4 | GHSA-hm4w-wwcw-mr6r |
| PyPI | pyasn1 | 0.6.4 | PYSEC-2026-3457 |
| Rocky Linux:8 | fence-agents | 0:4.2.1-129.el8_10.29 | RLSA-2026:53363 |
| Rocky Linux:9 | fence-agents | 0:4.10.0-110.el9_8.6 | RLSA-2026:53365 |
| Rocky Linux:10 | python-pyasn1 | 0:0.6.2-1.el10_2.1 | RLSA-2026:59243 |
| Rocky Linux:8 | python-pyasn1 | 0:0.3.7-6.el8_10.2 | RLSA-2026:59241 |
| Rocky Linux:9 | python-pyasn1 | 0:0.4.8-7.el9_8.1 | RLSA-2026:59242 |
| Rocky Linux:8 | resource-agents | 0:4.9.0-54.el8_10.37 | RLSA-2026:53364 |
| Ubuntu:22.04:LTS | pyasn1 | 0.4.8-1ubuntu0.3 | USN-8712-1 |
| Ubuntu:22.04:LTS | pyasn1 | 0.4.8-1ubuntu0.3 | UBUNTU-CVE-2026-59886 |
| Ubuntu:24.04:LTS | pyasn1 | 0.4.8-4ubuntu0.3 | UBUNTU-CVE-2026-59886 |
| Ubuntu:24.04:LTS | pyasn1 | 0.4.8-4ubuntu0.3 | USN-8712-1 |
| Ubuntu:26.04:LTS | pyasn1 | 0.6.3-1ubuntu0.1 | USN-8712-1 |
| Ubuntu:26.04:LTS | pyasn1 | 0.6.3-1ubuntu0.1 | UBUNTU-CVE-2026-59886 |
Affected products (as reported)
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r x_refsource_CONFIRM
- https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886 x_refsource_MISC
- https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 x_refsource_MISC