An update for python-pyasn1 is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3198 Final 1.0 1.0 2026-08-01 Initial 2026-08-01 2026-08-01 openEuler SA Tool V1.0 2026-08-01 python-pyasn1 security update An update for python-pyasn1 is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4 Abstract Syntax Notation One (ASN.1) is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python. Security Fix(es): pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.(CVE-2026-59884) pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.(CVE-2026-59885) pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.(CVE-2026-59886) An update for python-pyasn1 is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High python-pyasn1 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3198 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59884 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59885 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59886 https://nvd.nist.gov/vuln/detail/CVE-2026-59884 https://nvd.nist.gov/vuln/detail/CVE-2026-59885 https://nvd.nist.gov/vuln/detail/CVE-2026-59886 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 python-pyasn1-0.4.8-3.oe2003sp4.src.rpm python-pyasn1-0.4.8-6.oe2203sp4.src.rpm python-pyasn1-0.5.1-4.oe2403sp1.src.rpm python-pyasn1-0.5.1-4.oe2403sp3.src.rpm python-pyasn1-0.5.1-4.oe2403sp4.src.rpm python-pyasn1-help-0.4.8-3.oe2003sp4.noarch.rpm python2-pyasn1-0.4.8-3.oe2003sp4.noarch.rpm python3-pyasn1-0.4.8-3.oe2003sp4.noarch.rpm python-pyasn1-help-0.4.8-6.oe2203sp4.noarch.rpm python3-pyasn1-0.4.8-6.oe2203sp4.noarch.rpm python-pyasn1-help-0.5.1-4.oe2403sp1.noarch.rpm python3-pyasn1-0.5.1-4.oe2403sp1.noarch.rpm python-pyasn1-help-0.5.1-4.oe2403sp3.noarch.rpm python3-pyasn1-0.5.1-4.oe2403sp3.noarch.rpm python-pyasn1-help-0.5.1-4.oe2403sp4.noarch.rpm python3-pyasn1-0.5.1-4.oe2403sp4.noarch.rpm pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4. 2026-08-01 CVE-2026-59884 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-pyasn1 security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3198 pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4. 2026-08-01 CVE-2026-59885 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-pyasn1 security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3198 pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4. 2026-08-01 CVE-2026-59886 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-pyasn1 security update 2026-08-01 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3198