ALAS2023-2026-2000

References: CVE-2026-59884  CVE-2026-59885  CVE-2026-59886 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4. (CVE-2026-59884)

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4. (CVE-2026-59885)

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4. (CVE-2026-59886)

Issue Correction:
Run dnf update python-pyasn1 --releasever 2023.12.20260803 or dnf update --advisory ALAS2023-2026-2000 --releasever 2023.12.20260803 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

noarch:
    python3-pyasn1-0.4.8-4.amzn2023.0.5.noarch
    python3-pyasn1-modules-0.4.8-4.amzn2023.0.5.noarch
    python-pyasn1-doc-0.4.8-4.amzn2023.0.5.noarch

src:
    python-pyasn1-0.4.8-4.amzn2023.0.5.src