USN-9011-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-9011-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9011-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-9011-1
Upstream
CVE (7)
Published
2026-11-09T16:15:14Z
Modified
2026-11-10T02:58:35Z
Summary
pyasn1 vulnerabilities
Details

It was discovered that pyasn1 did not properly bound the size of long-form tag identifiers when parsing BER, CER, or DER encoded data. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59884)

It was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59885)

It was discovered that pyasn1 incorrectly handled conversion of decoded REAL values to Python float types. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU and memory resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59886)

It was discovered that pyasn1 incorrectly handled tracking component types when decoding containers without a schema. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119194)

It was discovered that pyasn1 processed fragmented constructed strings and indefinite-length ANY values in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue was only addressed in Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-119195)

It was discovered that pyasn1 processed fragmented constructed BIT STRING values in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-119196)

It was discovered that pyasn1 processed binary-encoded REAL values with large mantissas in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-119197)

References

Affected packages

Ubuntu:22.04:LTS
pyasn1

Package

Name
pyasn1
Purl
pkg:deb/ubuntu/pyasn1?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.4.8-1ubuntu0.4

Affected versions

0.*
0.4.8-1
0.4.8-1ubuntu0.1
0.4.8-1ubuntu0.2
0.4.8-1ubuntu0.3

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "pypy-pyasn1",
            "binary_version": "0.4.8-1ubuntu0.4"
        },
        {
            "binary_name": "python3-pyasn1",
            "binary_version": "0.4.8-1ubuntu0.4"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:22.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9011-1.json"
Ubuntu:24.04:LTS
pyasn1

Package

Name
pyasn1
Purl
pkg:deb/ubuntu/pyasn1?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.4.8-4ubuntu0.4

Affected versions

0.*
0.4.8-4
0.4.8-4ubuntu0.1
0.4.8-4ubuntu0.2
0.4.8-4ubuntu0.3

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "python3-pyasn1",
            "binary_version": "0.4.8-4ubuntu0.4"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:24.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9011-1.json"
Ubuntu:26.04:LTS
pyasn1

Package

Name
pyasn1
Purl
pkg:deb/ubuntu/pyasn1?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.6.3-1ubuntu0.2

Affected versions

0.*
0.6.1-1
0.6.1-1build1
0.6.2-1
0.6.3-1
0.6.3-1ubuntu0.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "python3-pyasn1",
            "binary_version": "0.6.3-1ubuntu0.2"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:26.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9011-1.json"
Ubuntu:26.10
pyasn1

Package

Name
pyasn1
Purl
pkg:deb/ubuntu/pyasn1?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.6.4-1ubuntu0.1

Affected versions

0.*
0.6.3-1
0.6.4-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "python3-pyasn1",
            "binary_version": "0.6.4-1ubuntu0.1"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:26.10"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9011-1.json"
Ubuntu:Pro:14.04:LTS
pyasn1

Package

Name
pyasn1
Purl
pkg:deb/ubuntu/pyasn1?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.1.7-1ubuntu2.1+esm2

Affected versions

0.*
0.1.4-0ubuntu1
0.1.7-1ubuntu1
0.1.7-1ubuntu2
0.1.7-1ubuntu2.1
0.1.7-1ubuntu2.1+esm1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "python-pyasn1",
            "binary_version": "0.1.7-1ubuntu2.1+esm2"
        },
        {
            "binary_name": "python3-pyasn1",
            "binary_version": "0.1.7-1ubuntu2.1+esm2"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:Pro:14.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9011-1.json"
Ubuntu:Pro:16.04:LTS
pyasn1

Package

Name
pyasn1
Purl
pkg:deb/ubuntu/pyasn1?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.1.9-1ubuntu0.1~esm2

Affected versions

0.*
0.1.8-2
0.1.9-1
0.1.9-1ubuntu0.1~esm1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "pypy-pyasn1",
            "binary_version": "0.1.9-1ubuntu0.1~esm2"
        },
        {
            "binary_name": "python-pyasn1",
            "binary_version": "0.1.9-1ubuntu0.1~esm2"
        },
        {
            "binary_name": "python3-pyasn1",
            "binary_version": "0.1.9-1ubuntu0.1~esm2"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:Pro:16.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9011-1.json"
Ubuntu:Pro:18.04:LTS
pyasn1

Package

Name
pyasn1
Purl
pkg:deb/ubuntu/pyasn1?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.4.2-3ubuntu0.18.04.1~esm2

Affected versions

0.*
0.1.9-2
0.4.2-3
0.4.2-3ubuntu0.18.04.1~esm1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "pypy-pyasn1",
            "binary_version": "0.4.2-3ubuntu0.18.04.1~esm2"
        },
        {
            "binary_name": "python-pyasn1",
            "binary_version": "0.4.2-3ubuntu0.18.04.1~esm2"
        },
        {
            "binary_name": "python3-pyasn1",
            "binary_version": "0.4.2-3ubuntu0.18.04.1~esm2"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:Pro:18.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9011-1.json"
Ubuntu:Pro:20.04:LTS
pyasn1

Package

Name
pyasn1
Purl
pkg:deb/ubuntu/pyasn1?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.4.2-3ubuntu0.20.04.1~esm2

Affected versions

0.*
0.4.2-3
0.4.2-3build1
0.4.2-3ubuntu0.20.04.1~esm1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "pypy-pyasn1",
            "binary_version": "0.4.2-3ubuntu0.20.04.1~esm2"
        },
        {
            "binary_name": "python-pyasn1",
            "binary_version": "0.4.2-3ubuntu0.20.04.1~esm2"
        },
        {
            "binary_name": "python3-pyasn1",
            "binary_version": "0.4.2-3ubuntu0.20.04.1~esm2"
        }
    ]
}

Database specific

cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:Pro:20.04:LTS"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-9011-1.json"