MGASA-2026-0380

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0380.html
Import Source
https://advisories.mageia.org/MGASA-2026-0380.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0380
Upstream
Published
2026-09-07T18:46:11Z
Modified
2026-09-07T19:00:02Z
Summary
Updated python-pyasn1 packages fix security vulnerabilities
Details

The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.

References
Credits

Affected packages

Mageia:10 / python-pyasn1

Package

Name
python-pyasn1
Purl
pkg:rpm/mageia/python-pyasn1?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.6.4-1.mga10

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0380.json"