Executive brief
A vulnerability in the pyasn1 library, which is used to handle encoded data in many Python applications, can allow an attacker to crash or slow down a service. By sending a specially crafted data packet, an attacker can force the system to consume excessive processor power or trigger an unhandled error. This can lead to a denial-of-service, making the affected application unavailable to legitimate users.
Technical details
The pyasn1 BER decoder (and by extension CER/DER) fails to bound the size of long-form tag IDs during parsing. An attacker can provide a crafted input with an extremely long tag ID, causing the decoder to accumulate continuation octets in a loop. This results in quadratic CPU consumption relative to the input size. Additionally, on Python 3.11+, the oversized tag ID can trigger an unhandled ValueError due to integer-to-string conversion limits during error message formatting, potentially bypassing application-level exception handling. The issue is fixed in version 0.6.4 by limiting tag IDs to 20 octets.
Affected products
- pyasn1 pyasn1 <= 0.6.3
Timeline
- 2026-07-09: disclosed: Vulnerability reported and patched in repository
- 2026-07-14: advisory: NVD publication date
- 2026-07-21: advisory: GitHub Advisory published