pyasn1 EUVD-2026-43956

Exploitation requires only that the target application feed attacker-controlled data to pyasn1's BER, CER, or DER decoder - no authentication, user interaction, or special configuration is needed (AV:N/AC:L/PR:N/UI:N), so any endpoint that decodes untrusted ASN.1 against a pre-0.6.4 pyasn1 is exposed. The concrete prerequisite is a decode path reachable by untrusted input (e.g. certificate/CRL parsing, SNMP, LDAP, or token handling); what limits exploitation is that the impact is availability-only (no data disclosure or code execution), the more severe unhandled-ValueError crash requires the target to run Python 3.11 or later, and applications that only decode trusted, internally generated ASN.1 are not realistically at risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a remotely triggerable, unauthenticated, low-complexity availability-only impact with no confidentiality or integrity effect - consistent with the description of a pure DoS. There is no EPSS score, KEV listing, or public exploit provided in the input, so real-world exploitation pressure appears low despite the high base score; the fix commit's test cases (1<<140 tags) demonstrate triggerability but are regression tests, not weaponized exploits. The realistic risk hinges on exposure: applications that decode attacker-controlled ASN.1 (certificate validation, SNMP agents, LDAP, token parsing) face genuine DoS exposure, while systems that only decode trusted internal data are low priority. No conflicting signals were observed - the vector and description agree that this is network-reachable availability loss; the main caveat is that the Python 3.11+ ValueError crash path is more severe (an immediate unhandled exception) than the quadratic slowdown seen on older interpreters.

An attacker submits a crafted certificate, SNMP packet, LDAP message, or token whose ASN.1 encoding contains a long-form tag with an excessive number of continuation octets to a network service that decodes it with pyasn1. On Python 3.11+ the decoder raises an unhandled ValueError while formatting the enormous tag ID, crashing the request or worker; on older interpreters the quadratic big-integer processing pins CPU. No public proof-of-concept exploit exists, but the patch's regression tests show the exact triggering encodings.