Is CVE-2026-59884 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59884 being exploited in the wild.

How severe is CVE-2026-59884?

High severity, with a CVSS score of 7.5, published 14 July 2026.

Which products and versions are affected?

Pyasn1 < 0.6.4, <= 0.6.3; pyasn1 (PyPI) ECOSYSTEM:introduced=0,fixed=0.6.4; pyssn1 (PyPI) <= 0.6.3.

Is there a fix for CVE-2026-59884?

Yes. pyasn1 (PyPI): upgrade to 0.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59884 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59884?

Check whether you run Pyasn1, pyasn1 (PyPI) or pyssn1 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59884: pyasn1 denial of service via unbounded long-form tag IDs in BER decoder

Q: Which products and versions are affected?

Pyasn1 < 0.6.4, <= 0.6.3; pyasn1 (PyPI) ECOSYSTEM:introduced=0,fixed=0.6.4; pyssn1 (PyPI) <= 0.6.3.

Q: Is there a fix for CVE-2026-59884?

Yes. pyasn1 (PyPI): upgrade to 0.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59884 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-59884?

Check whether you run Pyasn1, pyasn1 (PyPI) or pyssn1 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59884 · Severity: high · CVSS 7.5 · Published 2026-07-14

A vulnerability in the pyasn1 library, which is used to handle encoded data in many Python applications, can allow an attacker to crash or slow down a service. By sending a specially crafted data packet, an attacker can force the system to consume excessive processor power or trigger an unhandled error. This can lead to a denial-of-service, making the affected application unavailable to legitimate users.

Technologies: Pyasn1, pyasn1 (PyPI). Vendors: Pyasn1, PyPI.

Quick answers

Is CVE-2026-59884 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59884 being exploited in the wild.
How severe is CVE-2026-59884?: High severity, with a CVSS score of 7.5, published 14 July 2026.
Which products and versions are affected?: Pyasn1 < 0.6.4, <= 0.6.3; pyasn1 (PyPI) ECOSYSTEM:introduced=0,fixed=0.6.4; pyssn1 (PyPI) <= 0.6.3.
Is there a fix for CVE-2026-59884?: Yes. pyasn1 (PyPI): upgrade to 0.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59884 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59884?: Check whether you run Pyasn1, pyasn1 (PyPI) or pyssn1 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyasn1 (PyPI): upgrade to 0.6.4 or later
```
pip install "pyasn1>=0.6.4"
```

Technical details

The pyasn1 BER decoder (and by extension CER/DER) fails to bound the size of long-form tag IDs during parsing. An attacker can provide a crafted input with an extremely long tag ID, causing the decoder to accumulate continuation octets in a loop. This results in quadratic CPU consumption relative to the input size. Additionally, on Python 3.11+, the oversized tag ID can trigger an unhandled ValueError due to integer-to-string conversion limits during error message formatting, potentially bypassing application-level exception handling. The issue is fixed in version 0.6.4 by limiting tag IDs to 20 octets.

Affected products

pyasn1 pyasn1 <= 0.6.3

Identifiers

CVE-2026-59884
GHSA-m4p7-r5rc-7g4j
PYSEC-2026-3455

Timeline

2026-07-09: disclosed: Vulnerability reported and patched in repository
2026-07-14: advisory: NVD publication date
2026-07-21: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.