Home / mailings

PDF

[USN-8712-1] pyasn1 vulnerabilities

Posted on 01 September 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8712-1
September 01, 2026

pyasn1 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in pyasn1.

Software Description:
- pyasn1: ASN.1 library for Python

Details:

It was discovered that pyasn1 did not properly bound the size of long-form
tag identifiers when parsing BER, CER, or DER encoded data. An attacker
could possibly use this issue to cause applications decoding untrusted
ASN.1 data to consume excessive CPU resources, resulting in a denial of
service. (CVE-2026-59884)

It was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID
values in quadratic time relative to the number of arcs. An attacker could
possibly use this issue to cause applications decoding untrusted ASN.1 data
to consume excessive CPU resources, resulting in a denial of service.
(CVE-2026-59885)

It was discovered that pyasn1 incorrectly handled conversion of decoded
REAL values to Python float types. An attacker could possibly use this
issue to cause applications decoding untrusted ASN.1 data to consume
excessive CPU and memory resources, resulting in a denial of service.
(CVE-2026-59886)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
python3-pyasn1 0.6.3-1ubuntu0.1

Ubuntu 24.04 LTS
python3-pyasn1 0.4.8-4ubuntu0.3

Ubuntu 22.04 LTS
python3-pyasn1 0.4.8-1ubuntu0.3

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8712-1
CVE-2026-59884, CVE-2026-59885, CVE-2026-59886

Package Information:
https://launchpad.net/ubuntu/+source/pyasn1/0.6.3-1ubuntu0.1
https://launchpad.net/ubuntu/+source/pyasn1/0.4.8-4ubuntu0.3
https://launchpad.net/ubuntu/+source/pyasn1/0.4.8-1ubuntu0.3

--===============7050382906980945476==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP