pyasn1 CVE-2026-59885

The only prerequisite is that the target application passes attacker-influenced data to pyasn1's BER/CER/DER decoder.decode() (or re-encodes previously decoded attacker values through the encoder) on a version earlier than 0.6.4. The CVSS vector is PR:N/UI:N, so no authentication or user interaction is required where such a decode path is remotely reachable; the malicious input is simply an OBJECT IDENTIFIER or RELATIVE-OID with a very large number of arcs. Limiting factors: exploitation is bounded to code paths that actually decode untrusted ASN.1 - deployments that only parse trusted/local data, enforce small payload-size limits, or wrap decoding in strict timeouts substantially blunt the attack, and impact is availability degradation only (no code execution or data exposure).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the description: an unauthenticated remote attacker can trigger the condition with low complexity and no user interaction, but impact is confined to availability - there is no data disclosure or code execution. This is a genuine amplification/algorithmic-complexity DoS rather than a memory-safety issue, so real-world priority depends on exposure: services that decode attacker-controlled ASN.1 (LDAP front-ends, SNMP agents, certificate/token parsers) are meaningfully at risk, while internal-only usage is not. No EPSS score, KEV listing, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input; KEV=NO and POC=NO mean this should be treated as a patch-soon hardening issue, not an emergency. Note the effect is CPU exhaustion (a single decode stalls), not a crash, so a small number of requests can degrade a worker - worth verifying request-size limits and timeouts around any untrusted decode path.

An attacker sends a small crafted DER/BER blob containing an OBJECT IDENTIFIER with thousands of arcs (for example the 4096 single-byte-arc payload used in the fix's regression test) to a network service that decodes untrusted ASN.1, such as an LDAP or SNMP endpoint or a certificate/token validator. Each decode() call spends quadratic CPU on that tiny input, and a handful of concurrent requests can saturate worker processes and deny service to legitimate users. Given AV:N/AC:L and no authentication requirement in the CVSS vector, the request is trivial to deliver, though no weaponized public exploit is identified beyond the maintainer's proof-style test.