Pyasn1
Monthly
Quadratic-time denial of service in pyasn1 0.6.4 and earlier lets an attacker who can feed ASN.1 data into the library's BER, CER, or DER decoders pin a worker process on one CPU core for seconds or longer, scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with availability-only impact. The trigger is a binary-encoded REAL value (tag 0x09 with the binary/base-2 flag set) carrying a large mantissa; the cost is incurred entirely inside decode(), so the application never has to convert, print, or otherwise touch the decoded REAL - this is what separates it from the earlier float-conversion issue CVE-2026-59886 fixed in 0.6.4. Exposure is deployment-dependent: the advisory does not assert a network endpoint or unauthenticated access by itself, and any application-level cap on ASN.1 or mantissa size directly bounds the achievable CPU cost. No public exploit toolkit is confirmed and the issue is not in CISA KEV; the vendor advisory does publish a working reproduction script, and the fix ships in pyasn1 0.6.5.
Quadratic CPU consumption in pyasn1 through 0.6.4 lets an attacker who controls ASN.1 input keep a decoder worker busy far longer than the payload size justifies: a 0.8 MB BER value split into 200,000 constructed BIT STRING fragments costs about 7.4 seconds of CPU in the upstream benchmark, and a 4 MB conforming CER value costs about 2.6 seconds. The BER and CER decoders hit the path with or without an asn1Spec, while the DER decoder is exposed only through its schema-driven route when given asn1Spec=univ.BitString() and a definite-length constructed BIT STRING - schema-less DER rejects the same input. Impact is availability only (CPU exhaustion; no confidentiality or integrity effect), and exposure depends entirely on whether the calling application feeds unbounded untrusted ASN.1 to these decoders; no active exploitation is reported, and the upstream advisory publishes working reproducer code that demonstrates the cost growth.
Quadratic-time CPU exhaustion in pyasn1 0.6.4 and earlier allows remote, unauthenticated attackers to tie up decoding workers by supplying highly fragmented ASN.1 input - constructed BER/CER OCTET STRING or character-string values, or indefinite-length ANY content when an asn1Spec selects univ.Any - that is reassembled with repeated growing-bytes concatenation. The DER codec is also reachable through der.decode(data, asn1Spec=univ.OctetString()) for a definite-length constructed OCTET STRING and through constructed character strings used without a schema, even though those encodings are not valid DER. Impact is availability only (CVSS 7.5, C:N/I:N/A:H); the vendor rates the issue as requiring an application that decodes untrusted ASN.1 without size or CPU limits, and states that pre-authentication reachability through a specific protocol is application-specific. Fixed in pyasn1 0.6.5, which reassembles fragments in a list and joins once; a reproducibility PoC is published in the GHSA advisory, but no confirmed working exploit code and no active exploitation (CISA KEV) have been identified, so this is prioritized for patching this week rather than treated as an emergency.
Quadratic CPU consumption in pyasn1's schemaless BER/CER/DER container decoder (versions 0.3.3 through 0.6.4) lets remote unauthenticated attackers tie up a decoding service with a small, syntactically valid input. ConstructedPayloadDecoderBase._decodeComponentsSchemaless inserts every decoded component's TagSet into a growing set, so a container packed with distinct long-form tag IDs whose TagSet hashes collide forces each insertion to compare against all earlier colliding tags; the proof-of-concept script published in the upstream advisory shows decode CPU time rising from roughly 0.44s to 1.75s when the component count doubles from 3,200 to 6,400 on CPython 3.12.10 with pyasn1 0.6.4. Impact is confined to availability (decoded values and their order remain correct), exploitation requires the application to decode attacker-supplied bytes without an asn1Spec, no confirmed active exploitation or KEV listing exists at time of analysis, and the upstream fix is version 0.6.5, making this a this-week patch item rather than an emergency.
Denial of service in the pyasn1 Python ASN.1 library (versions prior to 0.6.4) allows a remote attacker to exhaust CPU and crash applications by supplying crafted BER, CER, or DER encoded data. The shared BER decoder parses long-form tags without bounding the tag ID size, so a malicious tag forces construction of an arbitrarily large integer whose processing scales quadratically, and on Python 3.11+ triggers unhandled ValueError exceptions in integer-to-string error formatting. No public exploit identified at time of analysis, though the fix commit ships proof-of-concept test cases; not listed in CISA KEV.
Denial of service in the pyasn1 Python ASN.1 library (all versions prior to 0.6.4) allows remote attackers to exhaust CPU by submitting a small crafted OBJECT IDENTIFIER or RELATIVE-OID whose arcs are decoded in quadratic time, so any application that calls decode() on untrusted ASN.1 data can be stalled per call; re-encoding such values triggers the same blow-up. Rated CVSS 7.5 (availability-only) with no confidentiality or integrity impact; no public exploit identified at time of analysis, though the fix commit ships a regression test that effectively demonstrates the trigger. As a foundational dependency behind LDAP, SNMP, X.509/PKI and crypto tooling across the Python ecosystem, its broad transitive reach makes this notable despite the modest severity.
Uncontrolled resource consumption in the pyasn1 Python ASN.1 library (versions prior to 0.6.4) lets remote attackers hang applications that decode untrusted BER/CER/DER data. A REAL value only a few bytes long can encode an enormous exponent; when the decoded univ.Real object is later printed, logged, compared, or converted via prettyPrint(), str(), int(), or float(), pyasn1 performs exact big-integer exponentiation that consumes excessive CPU and memory. There is no public exploit identified at time of analysis, but the network/no-auth/no-interaction, availability-only profile makes this a straightforward denial-of-service primitive; the issue is fixed in version 0.6.4.
pyasn1 is a generic ASN.1 library for Python. versions up to 0.6.2 is affected by allocation of resources without limits or throttling (CVSS 7.5).
Quadratic-time denial of service in pyasn1 0.6.4 and earlier lets an attacker who can feed ASN.1 data into the library's BER, CER, or DER decoders pin a worker process on one CPU core for seconds or longer, scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with availability-only impact. The trigger is a binary-encoded REAL value (tag 0x09 with the binary/base-2 flag set) carrying a large mantissa; the cost is incurred entirely inside decode(), so the application never has to convert, print, or otherwise touch the decoded REAL - this is what separates it from the earlier float-conversion issue CVE-2026-59886 fixed in 0.6.4. Exposure is deployment-dependent: the advisory does not assert a network endpoint or unauthenticated access by itself, and any application-level cap on ASN.1 or mantissa size directly bounds the achievable CPU cost. No public exploit toolkit is confirmed and the issue is not in CISA KEV; the vendor advisory does publish a working reproduction script, and the fix ships in pyasn1 0.6.5.
Quadratic CPU consumption in pyasn1 through 0.6.4 lets an attacker who controls ASN.1 input keep a decoder worker busy far longer than the payload size justifies: a 0.8 MB BER value split into 200,000 constructed BIT STRING fragments costs about 7.4 seconds of CPU in the upstream benchmark, and a 4 MB conforming CER value costs about 2.6 seconds. The BER and CER decoders hit the path with or without an asn1Spec, while the DER decoder is exposed only through its schema-driven route when given asn1Spec=univ.BitString() and a definite-length constructed BIT STRING - schema-less DER rejects the same input. Impact is availability only (CPU exhaustion; no confidentiality or integrity effect), and exposure depends entirely on whether the calling application feeds unbounded untrusted ASN.1 to these decoders; no active exploitation is reported, and the upstream advisory publishes working reproducer code that demonstrates the cost growth.
Quadratic-time CPU exhaustion in pyasn1 0.6.4 and earlier allows remote, unauthenticated attackers to tie up decoding workers by supplying highly fragmented ASN.1 input - constructed BER/CER OCTET STRING or character-string values, or indefinite-length ANY content when an asn1Spec selects univ.Any - that is reassembled with repeated growing-bytes concatenation. The DER codec is also reachable through der.decode(data, asn1Spec=univ.OctetString()) for a definite-length constructed OCTET STRING and through constructed character strings used without a schema, even though those encodings are not valid DER. Impact is availability only (CVSS 7.5, C:N/I:N/A:H); the vendor rates the issue as requiring an application that decodes untrusted ASN.1 without size or CPU limits, and states that pre-authentication reachability through a specific protocol is application-specific. Fixed in pyasn1 0.6.5, which reassembles fragments in a list and joins once; a reproducibility PoC is published in the GHSA advisory, but no confirmed working exploit code and no active exploitation (CISA KEV) have been identified, so this is prioritized for patching this week rather than treated as an emergency.
Quadratic CPU consumption in pyasn1's schemaless BER/CER/DER container decoder (versions 0.3.3 through 0.6.4) lets remote unauthenticated attackers tie up a decoding service with a small, syntactically valid input. ConstructedPayloadDecoderBase._decodeComponentsSchemaless inserts every decoded component's TagSet into a growing set, so a container packed with distinct long-form tag IDs whose TagSet hashes collide forces each insertion to compare against all earlier colliding tags; the proof-of-concept script published in the upstream advisory shows decode CPU time rising from roughly 0.44s to 1.75s when the component count doubles from 3,200 to 6,400 on CPython 3.12.10 with pyasn1 0.6.4. Impact is confined to availability (decoded values and their order remain correct), exploitation requires the application to decode attacker-supplied bytes without an asn1Spec, no confirmed active exploitation or KEV listing exists at time of analysis, and the upstream fix is version 0.6.5, making this a this-week patch item rather than an emergency.
Denial of service in the pyasn1 Python ASN.1 library (versions prior to 0.6.4) allows a remote attacker to exhaust CPU and crash applications by supplying crafted BER, CER, or DER encoded data. The shared BER decoder parses long-form tags without bounding the tag ID size, so a malicious tag forces construction of an arbitrarily large integer whose processing scales quadratically, and on Python 3.11+ triggers unhandled ValueError exceptions in integer-to-string error formatting. No public exploit identified at time of analysis, though the fix commit ships proof-of-concept test cases; not listed in CISA KEV.
Denial of service in the pyasn1 Python ASN.1 library (all versions prior to 0.6.4) allows remote attackers to exhaust CPU by submitting a small crafted OBJECT IDENTIFIER or RELATIVE-OID whose arcs are decoded in quadratic time, so any application that calls decode() on untrusted ASN.1 data can be stalled per call; re-encoding such values triggers the same blow-up. Rated CVSS 7.5 (availability-only) with no confidentiality or integrity impact; no public exploit identified at time of analysis, though the fix commit ships a regression test that effectively demonstrates the trigger. As a foundational dependency behind LDAP, SNMP, X.509/PKI and crypto tooling across the Python ecosystem, its broad transitive reach makes this notable despite the modest severity.
Uncontrolled resource consumption in the pyasn1 Python ASN.1 library (versions prior to 0.6.4) lets remote attackers hang applications that decode untrusted BER/CER/DER data. A REAL value only a few bytes long can encode an enormous exponent; when the decoded univ.Real object is later printed, logged, compared, or converted via prettyPrint(), str(), int(), or float(), pyasn1 performs exact big-integer exponentiation that consumes excessive CPU and memory. There is no public exploit identified at time of analysis, but the network/no-auth/no-interaction, availability-only profile makes this a straightforward denial-of-service primitive; the issue is fixed in version 0.6.4.
pyasn1 is a generic ASN.1 library for Python. versions up to 0.6.2 is affected by allocation of resources without limits or throttling (CVSS 7.5).