GHSA-m4p7-r5rc-7g4j CVE-2026-59884 PYSEC-2026-3455

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

High PyPI

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.62%; Chance of exploitation in the next 30 days. Higher than 49.54% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-400 Uncontrolled Resource Consumption
Fix: 0.6.4; Upgrade pyasn1 to this version or later

Description

Impact

The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.

Any application decoding untrusted BER/CER/DER input is affected.

Affected components

pyasn1.codec.ber.decoder — decode() and StreamingDecoder
pyasn1.codec.cer.decoder and pyasn1.codec.der.decoder, which inherit the same tag parsing
pyasn1.type.tag — Tag/TagSet reprs could raise ValueError when rendering oversized tag IDs (reachable through decoder error paths)

The encoders and the pyasn1.codec.native codec are not affected.

Patches

Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.

Workarounds

Bound the size of untrusted input passed to decode() before calling it.

Affected versions

PyPI

Package	Vulnerable	Fixed in
pyasn1	`< 0.6.4`	`0.6.4`
pyasn1	`< 0.6.4`	`0.6.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

pyasn1 PyPI → `0.6.4`

pip

pip install --upgrade "pyasn1>=0.6.4"

poetry

poetry add "pyasn1>=0.6.4"

uv

uv add "pyasn1>=0.6.4"

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-400: Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

How to prevent it

Architecture and Design: Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Architecture and Design: Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
Implementation: Ensure that all failures in resource allocation place the system into a safe posture.

References

Advisories

Fixes and patches

github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5

Packages

github.com/pyasn1/pyasn1

Timeline

Jul 14, 2026 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-2qm8-x737-gmw5 pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding	High	Also affects pyasn1
GHSA-mm57-4v3p-rchx pyasn1 has quadratic-complexity denial of service in binary REAL decoding	High	Also affects pyasn1
GHSA-9m75-vc3g-4x39 pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding	High	Also affects pyasn1
GHSA-fm9c-5rcf-2q5p pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding	High	Also affects pyasn1
GHSA-hm4w-wwcw-mr6r pyasn1: Uncontrolled resource consumption when converting decoded REAL values	High	Also affects pyasn1
GHSA-8ppf-4f7h-5ppj pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service	High	Also affects pyasn1
GHSA-jr27-m4p2-rc6r Denial of Service in pyasn1 via Unbounded Recursion	High	Also affects pyasn1
GHSA-63vm-454h-vhhq pyasn1 has a DoS vulnerability in decoder	High	Also affects pyasn1

Credits: HsiangNianian, mikeappsec, westonsteimel

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor