Medium [CVE-2026-59884] Denial of Service via crafted BER input

pyasn1 is a generic ASN.1 library for Python.

Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths.

Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

A remote attacker can exploit this by providing a specially crafted input, leading to the construction of an arbitrarily large integer. A flaw was found in pyasn1's BER decoder.

Many common uses of pyasn1 involve parsing trusted certificates or local configuration and are not exposed to this flaw. The realistic impact is a denial-of-service of the consuming Python process, with automatic recovery in typical service deployments.

Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.

Affected products named by the advisory: Red Hat AI Inference Server 3.3; Red Hat Hardened Images; Red Hat OpenShift AI 3.4; Exploit Intelligence; and 28 more.