Bug 2500041 (CVE-2026-59886)

Summary:	CVE-2026-59886 pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, alinfoot, amctagga, anpicker, anthomas, aoconnor, aos-team-art-private, aprice, aruklets, asdas, bbrownin, bniver, cmyers, dfreiber, dnakabaa, doconnor, dpaolell, drow, dschmidt, dtrifiro, dymurray, eborisov, ebourniv, eglynn, ehelms, flucifre, ggainey, gmeno, gparvin, groman, hasun, ibolton, ilpinto, jburrell, jdelft, jdobes, jfula, jjoyce, jlanda, jmatthew, jmitchel, jmontleo, jowilson, jpasqual, jpretori, jsamir, jschluet, jupierce, juwatts, jwong, kaycoth, kbempah, kgaikwad, kshier, lball, lcouzens, lgallett, lgarciaa, lhh, ltomasbo, mbenjamin, mbiarnes, mburns, mdellweg, mgarciac, mhackett, mhulan, mrunge, ngough, nmoumoul, nyancey, oezr, omaciel, ometelka, orabin, osousa, pakotvan, pcreech, pgaikwad, ppalepu, ppostler, prdhamdh, ptisnovs, rbryant, rchan, rhaigner, rhel-process-autobot, rjohnson, sbunciak, sghai, sidsharm, simaishi, slucidi, smallamp, solenoci, sostapov, sseago, stcannon, sthirugn, suppawar, syedriko, teagle, tmalecek, ttakamiy, vereddy, veshanka, vimartin, vkumar, vlaad, watson-tool-maintainers, weaton, xdharmai, yguenane, ykashtan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption, leading to a denial of service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2501248, 2501686, 2501687, 2501688
Bug Blocks:

Description OSIDB Bzimport 2026-07-14 17:01:42 UTC

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.

Comment 4 errata-xmlrpc 2026-08-04 17:56:53 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2026:50319 https://access.redhat.com/errata/RHSA-2026:50319

Comment 5 errata-xmlrpc 2026-08-04 18:44:29 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:50336 https://access.redhat.com/errata/RHSA-2026:50336

Comment 6 errata-xmlrpc 2026-08-11 08:54:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:53364 https://access.redhat.com/errata/RHSA-2026:53364

Comment 7 errata-xmlrpc 2026-08-11 10:11:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:53363 https://access.redhat.com/errata/RHSA-2026:53363

Comment 8 errata-xmlrpc 2026-08-11 10:16:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:53365 https://access.redhat.com/errata/RHSA-2026:53365

Comment 10 errata-xmlrpc 2026-08-24 05:26:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:58546 https://access.redhat.com/errata/RHSA-2026:58546

Comment 11 errata-xmlrpc 2026-08-24 05:34:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:58547 https://access.redhat.com/errata/RHSA-2026:58547

Comment 12 errata-xmlrpc 2026-08-24 06:30:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:58820 https://access.redhat.com/errata/RHSA-2026:58820

Comment 13 errata-xmlrpc 2026-08-24 06:35:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:58811 https://access.redhat.com/errata/RHSA-2026:58811

Comment 14 errata-xmlrpc 2026-08-24 06:41:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:58834 https://access.redhat.com/errata/RHSA-2026:58834

Comment 15 errata-xmlrpc 2026-08-24 07:02:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:58548 https://access.redhat.com/errata/RHSA-2026:58548

Comment 16 errata-xmlrpc 2026-08-24 07:11:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:58821 https://access.redhat.com/errata/RHSA-2026:58821

Comment 17 errata-xmlrpc 2026-08-24 07:21:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:58835 https://access.redhat.com/errata/RHSA-2026:58835

Comment 18 errata-xmlrpc 2026-08-24 07:32:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:58822 https://access.redhat.com/errata/RHSA-2026:58822

Comment 19 errata-xmlrpc 2026-08-24 16:25:54 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2026:59135 https://access.redhat.com/errata/RHSA-2026:59135

Comment 20 errata-xmlrpc 2026-08-24 16:27:34 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:59136 https://access.redhat.com/errata/RHSA-2026:59136

Comment 21 errata-xmlrpc 2026-08-25 00:49:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:59238 https://access.redhat.com/errata/RHSA-2026:59238

Comment 22 errata-xmlrpc 2026-08-25 01:01:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:59239 https://access.redhat.com/errata/RHSA-2026:59239

Comment 23 errata-xmlrpc 2026-08-25 01:03:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:59240 https://access.redhat.com/errata/RHSA-2026:59240

Comment 24 errata-xmlrpc 2026-08-25 01:05:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:59245 https://access.redhat.com/errata/RHSA-2026:59245

Comment 25 errata-xmlrpc 2026-08-25 01:07:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:59244 https://access.redhat.com/errata/RHSA-2026:59244

Comment 26 errata-xmlrpc 2026-08-25 01:11:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:59248 https://access.redhat.com/errata/RHSA-2026:59248

Comment 27 errata-xmlrpc 2026-08-25 01:12:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:59243 https://access.redhat.com/errata/RHSA-2026:59243

Comment 28 errata-xmlrpc 2026-08-25 01:19:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:59241 https://access.redhat.com/errata/RHSA-2026:59241

Comment 29 errata-xmlrpc 2026-08-25 01:24:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:59246 https://access.redhat.com/errata/RHSA-2026:59246

Comment 30 errata-xmlrpc 2026-08-25 01:31:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:59242 https://access.redhat.com/errata/RHSA-2026:59242

Comment 31 errata-xmlrpc 2026-08-25 01:35:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:59247 https://access.redhat.com/errata/RHSA-2026:59247

Comment 32 errata-xmlrpc 2026-08-25 07:38:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:59329 https://access.redhat.com/errata/RHSA-2026:59329