Vulnpedia
← All CVEs

CVE-2026-59885

HIGH 7.5 ALL-YEARS

Published 2026-07-14 · Last modified 2026-07-14 · GitHub_M · NVD: Analyzed

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.6%chance of exploitation in 30 days · 49th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable yes

Impact if exploited

7.5CVSS 3.1 · HIGH · CNA

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Pyasn1

Products Pyasn1

Weakness (CWE)

  • CWE-400: : Uncontrolled Resource Consumption
  • CWE-407: : Inefficient Algorithmic Complexity

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • pyasn1 PyPI

    pkg:pypi/pyasn1

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.6.4
    41 explicitly listed affected versions

    0.0.10a, 0.0.11a, 0.0.12a, 0.0.13, 0.0.13a, 0.0.13b, 0.0.6a, 0.0.9a, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.1, 0.2.2, 0.2.3, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.5.0, 0.5.1, 0.6.0, 0.6.1, 0.6.2, 0.6.3

    Additional upstream package constraints
    {
  "database": {
    "last_known_affected_version_range": "<= 0.6.3",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8ppf-4f7h-5ppj/GHSA-8ppf-4f7h-5ppj.json"
  }
}
    GitHub Advisory Database · GHSA-8ppf-4f7h-5ppj · Updated 2026-09-10T03:51:11.103855167Z
  • pyasn1 PyPI

    pkg:pypi/pyasn1

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.6.4
    41 explicitly listed affected versions

    0.0.10a, 0.0.11a, 0.0.12a, 0.0.13, 0.0.13a, 0.0.13b, 0.0.6a, 0.0.9a, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.1, 0.2.2, 0.2.3, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.5.0, 0.5.1, 0.6.0, 0.6.1, 0.6.2, 0.6.3

    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://github.com/pypa/advisory-database/blob/main/vulns/pyasn1/PYSEC-2026-3456.yaml"
  }
}
    PyPA · PYSEC-2026-3456 · Updated 2026-07-22T11:00:08.814095424Z

Vendor product assessments

Showing 32 of 1964 vendor product statements; 1932 omitted. Read the full vendor advisory.

  • python3.12-pyasn1-0:0.6.4-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch

    • vendor fix: For details on how to apply this update, refer to Ansible Automation Platform documentation. Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhelai3/bootc-cuda-rhel9@sha256:5f4fc4b62366cd6599d914e31b51a35f7072ea4f5aaae077769b69a0c4cde849_arm64 as a component of Red Hat Enterprise Linux AI 3.3 · fixed

    Vendor assessment for this product only.

    pkg:oci/bootc-cuda-rhel9@sha256%3A5f4fc4b62366cd6599d914e31b51a35f7072ea4f5aaae077769b69a0c4cde849?arch=arm64&repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9&tag=1788260684

    • vendor fix: The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. For details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.3 Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:78ef44a2ed8bb9ace068af64e10eeaddfb8d4e9826bea5554ef46ac2a5c9ad73_arm64 as a component of Red Hat OpenShift AI 2.25 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-feature-server-rhel9@sha256%3A78ef44a2ed8bb9ace068af64e10eeaddfb8d4e9826bea5554ef46ac2a5c9ad73?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1792148523

    • vendor fix: For Red Hat OpenShift AI 2.25.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-feature-server-rhel9@sha256:5df7d7c98f80be61f6b0b0adf11069494eea29c88387ed8b46538bf258dfb5a5_ppc64le as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-feature-server-rhel9@sha256%3A5df7d7c98f80be61f6b0b0adf11069494eea29c88387ed8b46538bf258dfb5a5?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9&tag=1791863220

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-mlflow-rhel9@sha256:4e1d4dc5b792364e2cfb31cd20e184c01aeff4ae0fa55dfc3d68aafb2a50a7f5_arm64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-mlflow-rhel9@sha256%3A4e1d4dc5b792364e2cfb31cd20e184c01aeff4ae0fa55dfc3d68aafb2a50a7f5?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-mlflow-rhel9&tag=1787226790

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256:15f5d799d1ba9318a757445ce94b84b7855b7c6ce37c46e199cac9d8eacf41a2_arm64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9@sha256%3A15f5d799d1ba9318a757445ce94b84b7855b7c6ce37c46e199cac9d8eacf41a2?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9&tag=1787073451

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9@sha256:aa9d828b90312ab56e9b68a70c39255817a9357c17cfcdbc56fe85d726635261_arm64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-trustyai-garak-lls-provider-dsp-rhel9@sha256%3Aaa9d828b90312ab56e9b68a70c39255817a9357c17cfcdbc56fe85d726635261?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9&tag=1791785804

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9@sha256:e15a412f74c1a63d3228cf473766769cc25245c29f84f189b82998fea7ed0524_amd64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-workbench-jupyter-pytorch-rocm-py312-rhel9@sha256%3Ae15a412f74c1a63d3228cf473766769cc25245c29f84f189b82998fea7ed0524?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9&tag=1787073546

    • vendor fix: For Red Hat OpenShift AI 3.4.4 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/quay/quay-rhel8@sha256:967c0ce73afdafe4fe21dc196bc938864b437f6a3c3af99b8247abfe4535b395_amd64 as a component of Red Hat Quay 3.10 · fixed

    Vendor assessment for this product only.

    pkg:oci/quay-rhel8@sha256%3A967c0ce73afdafe4fe21dc196bc938864b437f6a3c3af99b8247abfe4535b395?arch=amd64&repository_url=registry.redhat.io/quay/quay-rhel8&tag=1786395065

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/quay/quay-rhel8@sha256:bdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6_s390x as a component of Red Hat Quay 3.15 · fixed

    Vendor assessment for this product only.

    pkg:oci/quay-rhel8@sha256%3Abdfd5823d00ece5e608428350741629d132351a6789cdd042d07dbb4fd1f11a6?arch=s390x&repository_url=registry.redhat.io/quay/quay-rhel8&tag=1785261506

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/quay/quay-rhel8@sha256:f6cfbe5b8c58d6dbbddc1a809643ffe95f0e54a1a1571bde6748bd2664bb8883_s390x as a component of Red Hat Quay 3.9 · fixed

    Vendor assessment for this product only.

    pkg:oci/quay-rhel8@sha256%3Af6cfbe5b8c58d6dbbddc1a809643ffe95f0e54a1a1571bde6748bd2664bb8883?arch=s390x&repository_url=registry.redhat.io/quay/quay-rhel8&tag=1785950004

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 as a component of Exploit Intelligence · known affected

    Vendor assessment for this product only.

    pkg:oci/vulnerability-analysis-rhel9?repository_url=registry.redhat.io/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • openshift-service-mesh/kiali-rhel9-operator as a component of OpenShift Service Mesh 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/kiali-rhel9-operator?repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • ansible-automation-platform-25/ee-supported-rhel8 as a component of Red Hat Ansible Automation Platform 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/ee-supported-rhel8?repository_url=registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • ansible-automation-platform-26/gateway-rhel9-operator as a component of Red Hat Ansible Automation Platform 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/gateway-rhel9-operator?repository_url=registry.redhat.io/ansible-automation-platform-26/gateway-rhel9-operator

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • ansible-automation-platform-27/eda-controller-rhel9 as a component of Red Hat Ansible Automation Platform 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/eda-controller-rhel9?repository_url=registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • ansible-automation-platform-27/lightspeed-rhel9-operator as a component of Red Hat Ansible Automation Platform 2 · known affected

    Vendor assessment for this product only.

    pkg:oci/lightspeed-rhel9-operator?repository_url=registry.redhat.io/ansible-automation-platform-27/lightspeed-rhel9-operator

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • python3-pyasn1-modules as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python3-pyasn1-modules

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • resource-agents-sap as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/resource-agents-sap

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • python3-pyasn1 as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python3-pyasn1

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • python-pyasn1.src as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python-pyasn1?arch=src

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • rhtas/segment-reporting-rhel9 as a component of Red Hat Trusted Artifact Signer · known affected

    Vendor assessment for this product only.

    pkg:oci/segment-reporting-rhel9?repository_url=registry.redhat.io/rhtas/segment-reporting-rhel9

    • workaround: Update to pyasn1 version 0.6.4 or later when available for your product stream. The impact is limited to availability (denial of service) — an attacker cannot access or modify data. Applications that do not process untrusted ASN.1 input are at reduced risk.
    • none available: Fix deferred
    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • ansible-dev-tools+server-0:26.7.2-1.el10ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/ansible-dev-tools%[email protected]?arch=noarch

    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • python3.12-pulpcore-0:3.49.66-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:8eae9b630b66b4265022a1899df60ae1276d51d778b331b98e2bbbc967b2efe6_ppc64le as a component of Red Hat OpenShift AI 2.25 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-data-science-pipelines-argo-argoexec-rhel9@sha256%3A8eae9b630b66b4265022a1899df60ae1276d51d778b331b98e2bbbc967b2efe6?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9&tag=1788181065

    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-model-registry-rhel9@sha256:8d449a4feeaf74349e57e2804c164e38b814c021d5129cccbc6fdb7c8d8ccfe9_amd64 as a component of Red Hat OpenShift AI 2.25 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-model-registry-rhel9@sha256%3A8d449a4feeaf74349e57e2804c164e38b814c021d5129cccbc6fdb7c8d8ccfe9?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-model-registry-rhel9&tag=1788316737

    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:f80e5470a30f091bd1903062b972a90176833784c7f00335580cf3d63c1a3673_arm64 as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-data-science-pipelines-argo-argoexec-rhel9@sha256%3Af80e5470a30f091bd1903062b972a90176833784c7f00335580cf3d63c1a3673?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9&tag=1790132012

    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:8f46c12c1d0469bd16d0a076778c419910203849819401d85aac6d126c925c03_ppc64le as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256%3A8f46c12c1d0469bd16d0a076778c419910203849819401d85aac6d126c925c03?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9&tag=1790331087

    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-llm-d-batch-gateway-apiserver-rhel9@sha256:7824386a14d96de5dad37d80e3662a029ab528cd6b7210a7a80a897c70fd7e21_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-llm-d-batch-gateway-apiserver-rhel9@sha256%3A7824386a14d96de5dad37d80e3662a029ab528cd6b7210a7a80a897c70fd7e21?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-llm-d-batch-gateway-apiserver-rhel9&tag=1786630755

    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-model-registry-operator-rhel9@sha256:5c99b9f356df625462c2c92b29d1c12a1f4870d0d5b9d66d9f815e136f4e4812_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-model-registry-operator-rhel9@sha256%3A5c99b9f356df625462c2c92b29d1c12a1f4870d0d5b9d66d9f815e136f4e4812?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-model-registry-operator-rhel9&tag=1787103216

    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9@sha256:3fc5100f548f5d3ff1b071045803247067374b17dfa249ccafece7789f8f8f03_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-workbench-jupyter-minimal-cuda-py312-rhel9@sha256%3A3fc5100f548f5d3ff1b071045803247067374b17dfa249ccafece7789f8f8f03?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9&tag=1787074078

    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00
  • stf/smart-gateway-rhel9-operator as a component of Service Telemetry Framework 1.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code cannot be controlled by adversary

    pkg:oci/smart-gateway-rhel9-operator?repository_url=registry.redhat.io/stf/smart-gateway-rhel9-operator

    Red Hat · CVE-2026-59885 · Updated 2026-10-22T05:16:18+00:00

Known Affected Software Configurations

VendorProductVersion range
Pyasn1Pyasn1< 0.6.4

All CVSS metrics

  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS