Read the docs
TI-2026-42700 Aliases CVE-2026-59886GHSA-hm4w-wwcw-mr6r

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 56 fixed, 19 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print, log, or compare decoded objects. This issue is fixed in version 0.6.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0044 38th percentileScored 2026-11-07
Fix Partial pyasn1 (pyasn1): 0.6.4pyasn1 (PyPI): 0.6.4Red Hat: 56 advisoriesRed Hat: 56 fixed, 19 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pyasn1pyasn1before 0.6.40.6.4Patch availableCNA
—pyasn1 (PyPI)before 0.6.40.6.4Patch availableGHSA-hm4w-wwcw-mr6r
  • pyasn1 Vendorpyasn1 Affected before 0.6.4 Fixed in 0.6.4 Patch available CNA
  • pyasn1 (PyPI) Vendor— Affected before 0.6.4 Fixed in 0.6.4 Patch available GHSA-hm4w-wwcw-mr6r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:*before 0.6.4Vulnerablepyasn1
  • cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:* Versions before 0.6.4 Vulnerable ·pyasn1

Remediation

  • Fix · CNA pyasn1 (pyasn1) Fixed in 0.6.4
  • Fix · GHSA-hm4w-wwcw-mr6r pyasn1 (PyPI) Fixed in 0.6.4 Advisory →

Red Hat 56 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83121 Released 2026-10-14 · Red Hat rating Important
    Red Hat AI Inference 3.4.6 (rocm)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
Show 53 more Red Hat advisories
  • RHSA-2026:81110 Released 2026-10-12 · Red Hat rating Important
    Red Hat Quay 3.18.1
    • Red Hat Quay 3.18 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:77532 Released 2026-10-07 · Red Hat rating Important
    Release of components for Service Telemetry Framework 1.5.7
    • Red Hat OpenStack 1.5 registry.redhat.io/stf/prometheus-webhook-snmp-rhel9, registry.redhat.io/stf/sg-core-rhel9
  • RHSA-2026:74648 Released 2026-10-01 · Red Hat rating Important
    General availability of the satellite/iop-advisor-backend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-advisor-backend-rhel9
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:69255 Released 2026-09-21 · Red Hat rating Important
    Red Hat Quay 3.16.6
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:66018 Released 2026-09-09 · Red Hat rating Important
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:62336 Released 2026-09-01 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.6 enhancement update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:62335 Released 2026-09-01 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.6 enhancement update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:59518 Released 2026-08-25 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.6 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:59426 Released 2026-08-25 · Red Hat rating Important
    RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/segment-reporting-rhel9
  • RHSA-2026:59329 Released 2026-08-25 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS) resource-agents-4.1.1-61.el7_9.24, resource-agents-aliyun-4.1.1-61.el7_9.24, resource-agents-gcp-4.1.1-61.el7_9.24
    • Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS) resource-agents-4.1.1-61.el7_9.24, resource-agents-aliyun-4.1.1-61.el7_9.24, resource-agents-gcp-4.1.1-61.el7_9.24
    • Red Hat Enterprise Linux Server for SAP ELS (v. 7) resource-agents-4.1.1-61.el7_9.24, resource-agents-sap-4.1.1-61.el7_9.24, sap-cluster-connector-3.0.1-37.el7_9.24
    • Red Hat Enterprise Linux Server for SAPHANA ELS (v. 7) resource-agents-4.1.1-61.el7_9.24, resource-agents-sap-hana-4.1.1-61.el7_9.24, resource-agents-sap-hana-scaleout-0.164.0-6.el7_9.24
  • RHSA-2026:59247 Released 2026-08-25 · Red Hat rating Important
    python-pyasn1 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python-pyasn1-0.4.8-6.el9_6.2, python3-pyasn1-0.4.8-6.el9_6.2, python3-pyasn1-modules-0.4.8-6.el9_6.2
  • RHSA-2026:59242 Released 2026-08-25 · Red Hat rating Important
    python-pyasn1 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-pyasn1-0.4.8-7.el9_8.1, python3-pyasn1-0.4.8-7.el9_8.1, python3-pyasn1-modules-0.4.8-7.el9_8.1
  • RHSA-2026:59241 Released 2026-08-25 · Red Hat rating Important
    python-pyasn1 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python-pyasn1-0.3.7-6.el8_10.2, python3-pyasn1-0.3.7-6.el8_10.2, python3-pyasn1-modules-0.3.7-6.el8_10.2
  • RHSA-2026:59246 Released 2026-08-25 · Red Hat rating Important
    python-pyasn1 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) python-pyasn1-0.3.7-6.el8_6.2, python3-pyasn1-0.3.7-6.el8_6.2, python3-pyasn1-modules-0.3.7-6.el8_6.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) python-pyasn1-0.3.7-6.el8_6.2, python3-pyasn1-0.3.7-6.el8_6.2, python3-pyasn1-modules-0.3.7-6.el8_6.2
  • RHSA-2026:59243 Released 2026-08-25 · Red Hat rating Important
    python-pyasn1 security update
    • Red Hat Enterprise Linux AppStream (v. 10) python-pyasn1-0.6.2-1.el10_2.1, python3-pyasn1-0.6.2-1.el10_2.1, python3-pyasn1-modules-0.6.2-1.el10_2.1
  • RHSA-2026:59248 Released 2026-08-25 · Red Hat rating Important
    python-pyasn1 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) python-pyasn1-0.3.7-6.el8_4.2, python3-pyasn1-0.3.7-6.el8_4.2, python3-pyasn1-modules-0.3.7-6.el8_4.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) python-pyasn1-0.3.7-6.el8_4.2, python3-pyasn1-0.3.7-6.el8_4.2, python3-pyasn1-modules-0.3.7-6.el8_4.2
  • RHSA-2026:59244 Released 2026-08-25 · Red Hat rating Important
    python-pyasn1 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) python-pyasn1-0.4.8-6.el9_4.2, python3-pyasn1-0.4.8-6.el9_4.2, python3-pyasn1-modules-0.4.8-6.el9_4.2
  • RHSA-2026:59240 Released 2026-08-25 · Red Hat rating Important
    python-pyasn1 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) python-pyasn1-0.1.9-7.el7_9.3, python2-pyasn1-0.1.9-7.el7_9.3, python2-pyasn1-modules-0.1.9-7.el7_9.3
  • RHSA-2026:59245 Released 2026-08-25 · Red Hat rating Important
    python-pyasn1 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) python-pyasn1-0.3.7-6.el8_8.2, python3-pyasn1-0.3.7-6.el8_8.2, python3-pyasn1-modules-0.3.7-6.el8_8.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) python-pyasn1-0.3.7-6.el8_8.2, python3-pyasn1-0.3.7-6.el8_8.2, python3-pyasn1-modules-0.3.7-6.el8_8.2
  • RHSA-2026:59239 Released 2026-08-25 · Red Hat rating Important
    python-pyasn1 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) python-pyasn1-0.4.8-6.el9_2.2, python3-pyasn1-0.4.8-6.el9_2.2, python3-pyasn1-modules-0.4.8-6.el9_2.2
  • RHSA-2026:59238 Released 2026-08-25 · Red Hat rating Important
    python-pyasn1 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) python-pyasn1-0.6.2-1.el10_0.2, python3-pyasn1-0.6.2-1.el10_0.2, python3-pyasn1-modules-0.6.2-1.el10_0.2
  • RHSA-2026:59159 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8
  • RHSA-2026:59155 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9 +5
  • RHSA-2026:59153 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +3
  • RHSA-2026:59136 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-django-5.2.17-1.el10ap, python3-django-5.2.17-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-cli-4.7.16-1.el9ap, automation-controller-venv-tower-4.7.16-1.el9ap, automation-platform-ui-2.6.13-1.el9ap +3
  • RHSA-2026:59135 Released 2026-08-24 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-cli-4.6.32-1.el8ap, automation-controller-venv-tower-4.6.32-1.el8ap, automation-gateway-server-2.5.20260824-1.el8ap +3
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-cli-4.6.32-1.el9ap, automation-controller-venv-tower-4.6.32-1.el9ap, automation-gateway-server-2.5.20260824-1.el9ap +3
  • RHSA-2026:58822 Released 2026-08-24 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) fence-agents-4.2.1-112.el8_8.21, fence-agents-all-4.2.1-112.el8_8.21, fence-agents-amt-ws-4.2.1-112.el8_8.21 +40
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) fence-agents-4.2.1-112.el8_8.21, fence-agents-all-4.2.1-112.el8_8.21, fence-agents-amt-ws-4.2.1-112.el8_8.21 +39
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.21, fence-agents-aws-4.2.1-112.el8_8.21, fence-agents-azure-arm-4.2.1-112.el8_8.21 +2
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.21, fence-agents-aws-4.2.1-112.el8_8.21, fence-agents-azure-arm-4.2.1-112.el8_8.21 +2
  • RHSA-2026:58835 Released 2026-08-24 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) fence-agents-4.2.1-89.el8_6.26, fence-agents-all-4.2.1-89.el8_6.26, fence-agents-amt-ws-4.2.1-89.el8_6.26 +40
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) fence-agents-4.2.1-89.el8_6.26, fence-agents-all-4.2.1-89.el8_6.26, fence-agents-amt-ws-4.2.1-89.el8_6.26 +40
    • Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.26, fence-agents-aws-4.2.1-89.el8_6.26, fence-agents-azure-arm-4.2.1-89.el8_6.26 +1
  • RHSA-2026:58548 Released 2026-08-24 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-agents-4.10.0-86.el9_6.21, fence-agents-aliyun-4.10.0-86.el9_6.21, fence-agents-all-4.10.0-86.el9_6.21 +47
  • RHSA-2026:58821 Released 2026-08-24 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents-4.2.1-65.el8_4.32, fence-agents-all-4.2.1-65.el8_4.32, fence-agents-amt-ws-4.2.1-65.el8_4.32 +40
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) fence-agents-4.2.1-65.el8_4.32, fence-agents-all-4.2.1-65.el8_4.32, fence-agents-amt-ws-4.2.1-65.el8_4.32 +36
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.32, fence-agents-aws-4.2.1-65.el8_4.32, fence-agents-azure-arm-4.2.1-65.el8_4.32 +1
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.32, fence-agents-aws-4.2.1-65.el8_4.32, fence-agents-azure-arm-4.2.1-65.el8_4.32 +1
  • RHSA-2026:58834 Released 2026-08-24 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6) resource-agents-4.9.0-16.el8_6.24, resource-agents-aliyun-4.9.0-16.el8_6.24, resource-agents-gcp-4.9.0-16.el8_6.24 +1
  • RHSA-2026:58811 Released 2026-08-24 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) resource-agents-4.9.0-40.el8_8.21, resource-agents-aliyun-4.9.0-40.el8_8.21, resource-agents-gcp-4.9.0-40.el8_8.21 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) resource-agents-4.9.0-40.el8_8.21, resource-agents-aliyun-4.9.0-40.el8_8.21, resource-agents-gcp-4.9.0-40.el8_8.21 +1
  • RHSA-2026:58820 Released 2026-08-24 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) resource-agents-4.1.1-90.el8_4.27, resource-agents-aliyun-4.1.1-90.el8_4.27, resource-agents-gcp-4.1.1-90.el8_4.27
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) resource-agents-4.1.1-90.el8_4.27, resource-agents-aliyun-4.1.1-90.el8_4.27, resource-agents-gcp-4.1.1-90.el8_4.27
  • RHSA-2026:58547 Released 2026-08-24 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) fence-agents-4.10.0-62.el9_4.29, fence-agents-common-4.10.0-62.el9_4.29, fence-agents-compute-4.10.0-62.el9_4.29 +11
    • Red Hat Enterprise Linux High Availability E4S (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.29, fence-agents-all-4.10.0-62.el9_4.29, fence-agents-amt-ws-4.10.0-62.el9_4.29 +40
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.29, fence-agents-all-4.10.0-62.el9_4.29, fence-agents-amt-ws-4.10.0-62.el9_4.29 +39
  • RHSA-2026:58546 Released 2026-08-24 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-agents-4.10.0-43.el9_2.25, fence-agents-common-4.10.0-43.el9_2.25, fence-agents-compute-4.10.0-43.el9_2.25 +11
    • Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.25, fence-agents-all-4.10.0-43.el9_2.25, fence-agents-amt-ws-4.10.0-43.el9_2.25 +40
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.25, fence-agents-all-4.10.0-43.el9_2.25, fence-agents-amt-ws-4.10.0-43.el9_2.25 +39
  • RHSA-2026:56347 Released 2026-08-18 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-analyzer-addon-rhel9, registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-discovery-addon-rhel9 +4
  • RHSA-2026:54395 Released 2026-08-12 · Red Hat rating Important
    Red Hat Quay 3.17.4
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:53520 Released 2026-08-11 · Red Hat rating Important
    Red Hat Quay 3.10.25
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:53365 Released 2026-08-11 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-110.el9_8.6, fence-agents-aliyun-4.10.0-110.el9_8.6, fence-agents-all-4.10.0-110.el9_8.6 +47
  • RHSA-2026:53363 Released 2026-08-11 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-129.el8_10.29, fence-agents-all-4.2.1-129.el8_10.29, fence-agents-amt-ws-4.2.1-129.el8_10.29 +41
    • Red Hat Enterprise Linux HighAvailability (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.29, fence-agents-aws-4.2.1-129.el8_10.29, fence-agents-azure-arm-4.2.1-129.el8_10.29 +2
    • Red Hat Enterprise Linux ResilientStorage (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.29, fence-agents-aws-4.2.1-129.el8_10.29, fence-agents-azure-arm-4.2.1-129.el8_10.29 +2
  • RHSA-2026:53364 Released 2026-08-11 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) resource-agents-4.9.0-54.el8_10.37, resource-agents-aliyun-4.9.0-54.el8_10.37, resource-agents-gcp-4.9.0-54.el8_10.37 +1
    • Red Hat Enterprise Linux ResilientStorage (v. 8) resource-agents-4.9.0-54.el8_10.37, resource-agents-aliyun-4.9.0-54.el8_10.37, resource-agents-gcp-4.9.0-54.el8_10.37 +1
  • RHSA-2026:52968 Released 2026-08-10 · Red Hat rating Important
    Red Hat Quay 3.12.21
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:50931 Released 2026-08-05 · Red Hat rating Important
    Red Hat Quay 3.9.25
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:50904 Released 2026-08-05 · Red Hat rating Important
    RHTAS 1.4 - GA Release of Model Transparency 1.0.3
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-rhel9
  • RHSA-2026:50479 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:50336 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.7-1.el10ap, receptorctl-1.6.7-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.15-2.el9ap, automation-controller-cli-4.7.15-2.el9ap, automation-controller-server-4.7.15-2.el9ap +15
  • RHSA-2026:50340 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9 +7
  • RHSA-2026:50319 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.31-1.el8ap, automation-eda-controller-1.1.21-1.el8ap, automation-eda-controller-base-1.1.21-1.el8ap +11
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.31-1.el9ap, automation-eda-controller-1.1.21-1.el9ap, automation-eda-controller-base-1.1.21-1.el9ap +11
  • RHSA-2026:48933 Released 2026-07-30 · Red Hat rating Important
    Red Hat Quay 3.15.7
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:37094 Released 2026-07-09 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images mariadb-3:11.8.8-3.hum1@aarch64, mariadb-3:11.8.8-3.hum1@x86_64, mariadb-backup-3:11.8.8-3.hum1@aarch64 +37

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix planned: Will not fix
Lightspeed CoreAffectedNo fix yet
Migration Toolkit for ContainersAffectedNo fix planned: Will not fix
Migration Toolkit for VirtualizationAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat OpenStack Platform 17.1AffectedNo fix yet
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat AI Inference Server 3.3Fixed RHSA-2026:59518
Red Hat AI Inference Server 3.4Fixed RHSA-2026:83121
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:59159
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:50319, RHSA-2026:59135
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:50319, RHSA-2026:59135
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:50479, RHSA-2026:59155
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:50336, RHSA-2026:59136
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:50340, RHSA-2026:59153
Red Hat Enterprise Linux AI 3.3Fixed RHSA-2026:62335, RHSA-2026:62336
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:59243
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:53363, RHSA-2026:59241
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:53365, RHSA-2026:59242
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:58821, RHSA-2026:59248
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:58835, RHSA-2026:59246
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:58822, RHSA-2026:59245
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:58546, RHSA-2026:59239
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:58547, RHSA-2026:59244
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:59238
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:58548, RHSA-2026:59247
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:58821, RHSA-2026:59248
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:58835, RHSA-2026:59246
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:58822, RHSA-2026:59245
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2026:58820, RHSA-2026:58821
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2026:58811, RHSA-2026:58822
Red Hat Enterprise Linux High Availability E4S (v.9.2)Fixed RHSA-2026:58546
Red Hat Enterprise Linux High Availability E4S (v.9.4)Fixed RHSA-2026:58547
Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6)Fixed RHSA-2026:58834, RHSA-2026:58835
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2026:58811, RHSA-2026:58822
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2026:53363, RHSA-2026:53364
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2026:58820, RHSA-2026:58821
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)Fixed RHSA-2026:58546
Red Hat Enterprise Linux Resilient Storage E4S (v.9.4)Fixed RHSA-2026:58547
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2026:53363, RHSA-2026:53364
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:59240
Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS)Fixed RHSA-2026:59329
Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS)Fixed RHSA-2026:59329
Red Hat Enterprise Linux Server for SAP ELS (v. 7)Fixed RHSA-2026:59329
Red Hat Enterprise Linux Server for SAPHANA ELS (v. 7)Fixed RHSA-2026:59329
Red Hat Hardened ImagesFixed RHSA-2026:37094
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:56347
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenStack 1.5Fixed RHSA-2026:77532
Red Hat Quay 3.10Fixed RHSA-2026:53520
Red Hat Quay 3.12Fixed RHSA-2026:52968
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:48933
Red Hat Quay 3.16Fixed RHSA-2026:69255
Red Hat Quay 3.17Fixed RHSA-2026:54395
Red Hat Quay 3.18Fixed RHSA-2026:81110
Red Hat Quay 3.9Fixed RHSA-2026:50931
Red Hat Satellite 6.19Fixed RHSA-2026:74648
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:59426
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:50904
Red Hat Update Infrastructure 5Fixed RHSA-2026:66018
Not affected: 31 products
  • Migration Toolkit for Applications 8
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Enterprise Linux AI 3.3
  • Red Hat Hardened Images
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenStack 1.5
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.18
  • Red Hat Quay 3.9
  • Red Hat Update Infrastructure 5
  • Service Telemetry Framework 1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59886
  2. 2026-10-03 Alias added: GHSA-hm4w-wwcw-mr6r
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-07 Fix available: RHSA-2026:77532 · Red Hat
  5. 2026-10-07 Fix available: Red Hat OpenStack 1.5 · Red Hat
  6. 2026-10-13 Fix available: RHSA-2026:81110 · Red Hat
  7. 2026-10-13 Fix available: Red Hat Quay 3.18 · Red Hat
  8. 2026-10-16 Fix available: RHSA-2026:83121 · Red Hat
  9. 2026-10-16 Fix available: Red Hat AI Inference Server 3.4 · Red Hat
  10. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  11. 2026-10-20 Affected versions changed · Red Hat
  12. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  13. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
  14. 2026-10-30 Affected versions changed · Red Hat
  15. 2026-11-02 Affected versions changed · Red Hat
  16. 2026-11-03 Affected versions changed · Red Hat
  17. 2026-11-04 Priority changed: MEDIUM → LOW

References

Patch 1

Advisory 2

Other 2

  • TI-2026-23747 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVSS 3.1HIGH 7.5
  • TI-2026-18923 pyasn1 has a DoS vulnerability in decoder CVSS 3.1HIGH 7.5
  • TI-2026-42699 pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service CVSS 3.1HIGH 7.5
  • TI-2026-42698 pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences