Vulnpedia
← All CVEs

CVE-2026-59884

HIGH 7.5 ALL-YEARS

Published 2026-07-14 · Last modified 2026-07-15 · GitHub_M · NVD: Analyzed

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.6%chance of exploitation in 30 days · 49th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable yes

Impact if exploited

7.5CVSS 3.1 · HIGH · CNA

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Pyasn1

Products Pyasn1

Weakness (CWE)

  • CWE-400: : Uncontrolled Resource Consumption

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • pyasn1 PyPI

    pkg:pypi/pyasn1

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.6.4
    41 explicitly listed affected versions

    0.0.10a, 0.0.11a, 0.0.12a, 0.0.13, 0.0.13a, 0.0.13b, 0.0.6a, 0.0.9a, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.1, 0.2.2, 0.2.3, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.5.0, 0.5.1, 0.6.0, 0.6.1, 0.6.2, 0.6.3

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-m4p7-r5rc-7g4j/GHSA-m4p7-r5rc-7g4j.json"
  }
}
    GitHub Advisory Database · GHSA-m4p7-r5rc-7g4j · Updated 2026-09-10T03:50:52.562707948Z
  • pyasn1 PyPI

    pkg:pypi/pyasn1

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.6.4
    41 explicitly listed affected versions

    0.0.10a, 0.0.11a, 0.0.12a, 0.0.13, 0.0.13a, 0.0.13b, 0.0.6a, 0.0.9a, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.1, 0.2.2, 0.2.3, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.5.0, 0.5.1, 0.6.0, 0.6.1, 0.6.2, 0.6.3

    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pyasn1/PYSEC-2026-3455.yaml"
  }
}
    PyPA · PYSEC-2026-3455 · Updated 2026-07-22T11:00:08.839373736Z

Vendor product assessments

Showing 32 of 1207 vendor product statements; 1175 omitted. Read the full vendor advisory.

  • registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:5417790c2abbff7a0b4ca9fcd672a8e613a1cdfe2cf8afa10ec47a8883905189_amd64 as a component of Red Hat AI Inference Server 3.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/model-opt-cuda-rhel9@sha256%3A5417790c2abbff7a0b4ca9fcd672a8e613a1cdfe2cf8afa10ec47a8883905189?arch=amd64&repository_url=registry.redhat.io/rhaiis/model-opt-cuda-rhel9&tag=1787601159

    • vendor fix: For more information visit https://access.redhat.com/errata/RHSA-2026:59518 Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9@sha256:7a63d3116445dfc773d9b004b4c31e2f3ee7ef244a783c2e3d16582e285b35e5_amd64 as a component of Red Hat Enterprise Linux AI 3.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/bootc-gcp-cuda-rhel9@sha256%3A7a63d3116445dfc773d9b004b4c31e2f3ee7ef244a783c2e3d16582e285b35e5?arch=amd64&repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9&tag=1788273977

    • vendor fix: The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. For details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.3 Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:78ef44a2ed8bb9ace068af64e10eeaddfb8d4e9826bea5554ef46ac2a5c9ad73_arm64 as a component of Red Hat OpenShift AI 2.25 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-feature-server-rhel9@sha256%3A78ef44a2ed8bb9ace068af64e10eeaddfb8d4e9826bea5554ef46ac2a5c9ad73?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1792148523

    • vendor fix: For Red Hat OpenShift AI 2.25.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:5df7d7c98f80be61f6b0b0adf11069494eea29c88387ed8b46538bf258dfb5a5_ppc64le as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-feature-server-rhel9@sha256%3A5df7d7c98f80be61f6b0b0adf11069494eea29c88387ed8b46538bf258dfb5a5?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1791863220

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4e1d4dc5b792364e2cfb31cd20e184c01aeff4ae0fa55dfc3d68aafb2a50a7f5_arm64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-mlflow-rhel9@sha256%3A4e1d4dc5b792364e2cfb31cd20e184c01aeff4ae0fa55dfc3d68aafb2a50a7f5?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-mlflow-rhel9&tag=1787226790

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9@sha256:69ee4240b85018bdcf1da71892e2f9af24ee32e3f28d92201cfd6f8e30027a64_amd64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-pipeline-runtime-datascience-cpu-py312-rhel9@sha256%3A69ee4240b85018bdcf1da71892e2f9af24ee32e3f28d92201cfd6f8e30027a64?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9&tag=1787073866

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256:a9ada15c58e4d22767510fc654207223b5b586c89a1b897d5cc92647158a56ad_amd64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256%3Aa9ada15c58e4d22767510fc654207223b5b586c89a1b897d5cc92647158a56ad?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9&tag=1787073451

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-training-cuda128-torch29-py312-rhel9@sha256:d5cc3e7ad03f83104f3d1d4038fb2a4fa11dfa7501ce6be28ac568459a56f089_amd64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-training-cuda128-torch29-py312-rhel9@sha256%3Ad5cc3e7ad03f83104f3d1d4038fb2a4fa11dfa7501ce6be28ac568459a56f089?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-training-cuda128-torch29-py312-rhel9&tag=1786611803

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9@sha256:8b383544df737cf00bac9ce111db652e418e7c5afac87178545e81d63dda5396_ppc64le as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-workbench-codeserver-datascience-cpu-py312-rhel9@sha256%3A8b383544df737cf00bac9ce111db652e418e7c5afac87178545e81d63dda5396?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9&tag=1787121387

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9@sha256:e15a412f74c1a63d3228cf473766769cc25245c29f84f189b82998fea7ed0524_amd64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-workbench-jupyter-pytorch-rocm-py312-rhel9@sha256%3Ae15a412f74c1a63d3228cf473766769cc25245c29f84f189b82998fea7ed0524?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9&tag=1787073546

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9@sha256:c78ea41efa92d8e87111cb254c1943ae285b326c68a0749c5b77c12ceb8209b5_amd64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-workbench-jupyter-trustyai-cpu-py312-rhel9@sha256%3Ac78ea41efa92d8e87111cb254c1943ae285b326c68a0749c5b77c12ceb8209b5?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9&tag=1787073593

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 as a component of Exploit Intelligence · known affected

    Vendor assessment for this product only.

    pkg:oci/vulnerability-analysis-rhel9?repository_url=registry.redhat.io/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • openshift-service-mesh/kiali-rhel9-operator as a component of OpenShift Service Mesh 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/kiali-rhel9-operator?repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • ansible-automation-platform-24/platform-resource-runner-rhel8 as a component of Red Hat Ansible Automation Platform 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/platform-resource-runner-rhel8?repository_url=registry.redhat.io/ansible-automation-platform-24/platform-resource-runner-rhel8

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • ansible-automation-platform-26/gateway-rhel9-operator as a component of Red Hat Ansible Automation Platform 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/gateway-rhel9-operator?repository_url=registry.redhat.io/ansible-automation-platform-26/gateway-rhel9-operator

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • ansible-automation-platform-27/eda-controller-rhel9 as a component of Red Hat Ansible Automation Platform 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/eda-controller-rhel9?repository_url=registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • ansible-automation-platform-27/platform-resource-rhel9-operator as a component of Red Hat Ansible Automation Platform 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/platform-resource-rhel9-operator?repository_url=registry.redhat.io/ansible-automation-platform-27/platform-resource-rhel9-operator

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • python-pyasn1.src as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python-pyasn1?arch=src

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • resource-agents.src as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/resource-agents?arch=src

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    • none available: Affected
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • rhoso-operators/ee-openstack-ansible-ee-rhel9 as a component of Red Hat OpenStack Platform 18.0 · known affected

    Vendor assessment for this product only.

    pkg:oci/ee-openstack-ansible-ee-rhel9?repository_url=registry.redhat.io/rhoso-operators/ee-openstack-ansible-ee-rhel9

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • stf/smart-gateway-rhel9-operator as a component of Service Telemetry Framework 1.5 · known affected

    Vendor assessment for this product only.

    pkg:oci/smart-gateway-rhel9-operator?repository_url=registry.redhat.io/stf/smart-gateway-rhel9-operator

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1/BER input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9@sha256:e78b6e0cc5eeb8a46beda69660499f08322fa0d59d382dcd1349af2a0e96e352_amd64 as a component of Red Hat Enterprise Linux AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/bootc-azure-rocm-rhel9@sha256%3Ae78b6e0cc5eeb8a46beda69660499f08322fa0d59d382dcd1349af2a0e96e352?arch=amd64&repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9&tag=1788273908

    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-model-registry-rhel9@sha256:d1b9e5c33407a54d27fa385cbebcda4b5342a3fa22015392bf6ace2048b45354_ppc64le as a component of Red Hat OpenShift AI 2.25 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-model-registry-rhel9@sha256%3Ad1b9e5c33407a54d27fa385cbebcda4b5342a3fa22015392bf6ace2048b45354?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-model-registry-rhel9&tag=1791864681

    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:8b5292b6c75adc97657b5dcf0ac6e9792cd90c7d39b35fd2feaaf3512d90786d_amd64 as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-feature-server-rhel9@sha256%3A8b5292b6c75adc97657b5dcf0ac6e9792cd90c7d39b35fd2feaaf3512d90786d?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1789745631

    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-operator-bundle@sha256:ae32485cbaa3a592a20fb1fcd88fcd70c2dd32425f8ed4b220a04361c5a0d332_amd64 as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-operator-bundle@sha256%3Aae32485cbaa3a592a20fb1fcd88fcd70c2dd32425f8ed4b220a04361c5a0d332?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-operator-bundle&tag=1790687427

    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-built-in-detector-rhel9@sha256:3037ef27d81723dbe3ca98bf55c5c93fff42f3fad5935559cbf6eb272778ed7f_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-built-in-detector-rhel9@sha256%3A3037ef27d81723dbe3ca98bf55c5c93fff42f3fad5935559cbf6eb272778ed7f?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-built-in-detector-rhel9&tag=1786617316

    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-kserve-router-rhel9@sha256:3d602b9c38076730a0972ed143ff886d2018ef9ffbcc9ca339ad8dade8bfb05f_ppc64le as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kserve-router-rhel9@sha256%3A3d602b9c38076730a0972ed143ff886d2018ef9ffbcc9ca339ad8dade8bfb05f?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-kserve-router-rhel9&tag=1791468401

    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9@sha256:4bf7ba62f0216fba6d2951bdef4ba108652781a3d83169e0d1ea7ef53a686c4c_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-ml-pipelines-persistenceagent-v2-rhel9@sha256%3A4bf7ba62f0216fba6d2951bdef4ba108652781a3d83169e0d1ea7ef53a686c4c?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9&tag=1787332141

    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-model-registry-job-async-upload-rhel9@sha256:e8ae33b9ef41b33d120fd3aecc214660c22e5903f4fbf03b57121f1fab4218ce_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-model-registry-job-async-upload-rhel9@sha256%3Ae8ae33b9ef41b33d120fd3aecc214660c22e5903f4fbf03b57121f1fab4218ce?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-model-registry-job-async-upload-rhel9&tag=1791870571

    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • registry.redhat.io/rhoai/odh-th06-rocm64-torch291-py312-rhel9@sha256:30dcf995cf88e3b12fb2ed508e357b2801bbaa43e43af2a6791d6dd125b7e35e_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-th06-rocm64-torch291-py312-rhel9@sha256%3A30dcf995cf88e3b12fb2ed508e357b2801bbaa43e43af2a6791d6dd125b7e35e?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-th06-rocm64-torch291-py312-rhel9&tag=1791872119

    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00
  • rhoai/odh-trustyai-nemo-guardrails-server-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-trustyai-nemo-guardrails-server-rhel9?repository_url=registry.redhat.io/rhoai/odh-trustyai-nemo-guardrails-server-rhel9

    Red Hat · CVE-2026-59884 · Updated 2026-10-22T05:53:23+00:00

Known Affected Software Configurations

VendorProductVersion range
Pyasn1Pyasn1< 0.6.4

All CVSS metrics

  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS