Hi,

The following vulnerabilities were published for pyasn1.

CVE-2026-59884[0]:
| pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the
| BER decoder shared by the CER and DER codecs parses long-form tags
| by accumulating continuation octets without an upper bound on the
| tag ID size, allowing a crafted input to force construction of an
| arbitrarily large integer with CPU cost growing quadratically and to
| trigger unhandled ValueError exceptions in Python 3.11+ error
| formatting paths. Any application decoding untrusted BER, CER, or
| DER input is affected. This issue is fixed in version 0.6.4.


CVE-2026-59885[1]:
| pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the
| BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-
| OID values in quadratic time relative to the number of arcs, so a
| small crafted payload containing an OID with many arcs consumes
| excessive CPU per decode() call and can deny service to applications
| that decode untrusted ASN.1 data. The corresponding encoders have
| the same quadratic behavior when an application re-encodes
| previously decoded attacker-supplied values. This issue is fixed in
| version 0.6.4.


CVE-2026-59886[2]:
| pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the
| univ.Real type converted its mantissa, base, and exponent value to a
| Python float using exact big-integer exponentiation. A BER, CER, or
| DER encoded REAL value only a few bytes long can carry a very large
| exponent, causing float conversion through prettyPrint(), str(),
| comparison, arithmetic, int(), or an explicit float() call to
| consume excessive CPU and memory and hang applications that decode
| untrusted ASN.1 data and then print, log, or compare decoded
| objects. This issue is fixed in version 0.6.4.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-59884
https://www.cve.org/CVERecord?id=CVE-2026-59884
[1] https://security-tracker.debian.org/tracker/CVE-2026-59885
https://www.cve.org/CVERecord?id=CVE-2026-59885
[2] https://security-tracker.debian.org/tracker/CVE-2026-59886
https://www.cve.org/CVERecord?id=CVE-2026-59886

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore