GHSA-8ppf-4f7h-5ppj

Suggest an improvement
Source
https://github.com/advisories/GHSA-8ppf-4f7h-5ppj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8ppf-4f7h-5ppj/GHSA-8ppf-4f7h-5ppj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8ppf-4f7h-5ppj
Aliases
Downstream
Published
2026-07-21T19:11:03Z
Modified
2026-07-22T11:11:16.942605742Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
Details

Impact

The BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload (tens of kilobytes) containing an OID with many arcs consumes seconds of CPU per decode() call, allowing denial of service in any application that decodes untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos, etc.). The corresponding encoders have the same quadratic behavior, reachable when an application re-encodes previously decoded attacker-supplied values.

The arc-size limit introduced for CVE-2026-23490 bounds the byte length of an individual arc but not the number of arcs, so it does not mitigate this issue.

Affected components

ObjectIdentifierPayloadDecoder and RelativeOIDPayloadDecoder in pyasn1/codec/ber/decoder.py; ObjectIdentifierEncoder and RelativeOIDEncoder in pyasn1/codec/ber/encoder.py. The CER and DER codecs inherit these and are equally affected.

Patches

Fixed in pyasn1 0.6.4: arc accumulation in both decoders and encoders now runs in linear time.

Workarounds

Limit the size of untrusted ASN.1 input before decoding.

Database specific 
{
    "github_reviewed_at": "2026-07-21T19:11:03Z",
    "nvd_published_at": "2026-07-14T17:17:14Z",
    "cwe_ids": [
        "CWE-400",
        "CWE-407"
    ],
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

PyPI / pyasn1

Package

Name
pyasn1
View open source insights on deps.dev
Purl
pkg:pypi/pyasn1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.6.4

Affected versions

0.*
0.0.6a
0.0.9a
0.0.10a
0.0.11a
0.0.12a
0.0.13a
0.0.13b
0.0.13
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.1
0.2.2
0.2.3
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3

Database specific

last_known_affected_version_range 
"<= 0.6.3"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8ppf-4f7h-5ppj/GHSA-8ppf-4f7h-5ppj.json"