From 2639145a32c8292a491fe7edbf80088e3ecba807 Mon Sep 17 00:00:00 2001
From: Sachin Sampras M <sampras343@gmail.com>
Date: Mon, 20 Jul 2026 11:47:59 +0100
Subject: [PATCH] chore(deps): bump pyasn1 minimum to 0.6.4 for CVE-2026-59886

Addresses CVE-2026-59886: DoS via crafted ASN.1 REAL values causing
excessive memory and CPU consumption in Real.__float__().
Fixed in pyasn1 0.6.4.
---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index f71aa451..d0917b86 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -40,7 +40,7 @@ dependencies = [
   "cryptography>=46.0.7",
   "in-toto-attestation",
   "oras>=0.2.30",
-  "pyasn1>=0.6.2",
+  "pyasn1>=0.6.4",
   "sigstore>=4.2",
   "sigstore-models>=0.0.5",
   "typing_extensions",