pyasn1 EUVD-2026-43738

The target application must decode attacker-supplied BER/CER/DER data with pyasn1 (<0.6.4) AND subsequently trigger float conversion of a decoded univ.Real - via prettyPrint(), str()/repr(), logging, comparison, arithmetic, int(), or an explicit float() call. The malicious input is a compact ASN.1 REAL (universal tag 9) whose variable-length exponent field encodes a very large exponent (the fix's regression tests use exponents such as 262140 and 76354972). No authentication and no user interaction are required (PR:N/UI:N). The limiting factor is application behavior: an application that decodes but never prints, logs, compares, or numerically converts the Real object does not reach the hang - exhaustion only occurs when the decoded value is materialized as a float.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, High) is internally consistent with the description: an unauthenticated remote attacker with no user interaction can trigger availability loss only (C:N/I:N), which matches a pure DoS. The one caveat is that exploitation is not purely a decode operation - the malicious object must additionally be printed, logged, compared, or numerically converted by the consuming application, a condition CVSS folds into the base score but which somewhat lowers real-world universality. Because pyasn1 is almost always used behind higher-level parsers (LDAP, PKI, SNMP) that routinely log or compare decoded fields, the practical exposure is broad. It is not listed in CISA KEV and no POC was provided, so this is not confirmed active exploitation; however, the low attack complexity and trivial payload size make it an easy, reliable hang rather than a theoretical high-CVSS-but-low-real-risk issue. Treat as a genuine patch priority for services that ingest untrusted ASN.1. No EPSS score was supplied in the input, so probabilistic exploitation likelihood could not be cross-referenced.

An attacker sends a service that decodes untrusted ASN.1 (for example an LDAP, PKI/certificate, or SNMP endpoint) a tiny crafted BER/CER/DER REAL value carrying a huge exponent. When the application logs, prints, or compares the decoded object, pyasn1 attempts exact big-integer exponentiation, pinning CPU and exhausting memory until the worker hangs or the process is killed. No exploit code was provided, but the payload is only a handful of bytes and the attack complexity is low (AC:L).