Backport upstream commit 90d5e17 to fix CVE-2026-59886, a denial
of service vulnerability in the Real type's __float__() method.
The flaw allowed astronomically large integer materialization
via pow(). The patch rewrites __float__() to use math.ldexp()
for base-2 values, adds overflow protection for base-10 values,
fixes integer division in __normalizeBase10(), and handles zero
mantissa early. Comprehensive tests are added for BER, CER, DER
decoders and the Real type unit tests.
CVE: CVE-2026-59886
Upstream patches:
- 90d5e17239.patch
Resolves: RHEL-217908
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
