GHSA-m4p7-r5rc-7g4j

Suggest an improvement
Source
https://github.com/advisories/GHSA-m4p7-r5rc-7g4j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-m4p7-r5rc-7g4j/GHSA-m4p7-r5rc-7g4j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m4p7-r5rc-7g4j
Aliases
Downstream
CGA (62)
ECHO (1)
MINI (27)
Published
2026-07-21T19:10:11Z
Modified
2026-09-10T03:50:52Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
Details

Impact

The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.

Any application decoding untrusted BER/CER/DER input is affected.

Affected components

  • pyasn1.codec.ber.decoder — decode() and StreamingDecoder
  • pyasn1.codec.cer.decoder and pyasn1.codec.der.decoder, which inherit the same tag parsing
  • pyasn1.type.tag — Tag/TagSet reprs could raise ValueError when rendering oversized tag IDs (reachable through decoder error paths)

The encoders and the pyasn1.codec.native codec are not affected.

Patches

Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.

Workarounds

Bound the size of untrusted input passed to decode() before calling it.

Database specific 
{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-21T19:10:11Z",
    "nvd_published_at":  "2026-07-14T17:17:14Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / pyasn1

Package

Name
pyasn1
View open source insights on deps.dev
Purl
pkg:pypi/pyasn1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.6.4

Affected versions

0.*
0.0.6a
0.0.9a
0.0.10a
0.0.11a
0.0.12a
0.0.13a
0.0.13b
0.0.13
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.1
0.2.2
0.2.3
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-m4p7-r5rc-7g4j/GHSA-m4p7-r5rc-7g4j.json"