AZL-92433
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-92433.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-92433
- Upstream
- Published
- 2026-07-14T17:17:14Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-59884 affecting package python-pyasn1 for versions less than 0.4.8-3
- Details
-
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
- References