PYSEC-2026-3455

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/pyasn1/PYSEC-2026-3455.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-3455

Aliases

Published

2026-07-14T17:17:14.750Z

Modified

2026-07-22T11:00:08.839373736Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.

References

Affected packages

PyPI / pyasn1

Package

Name: pyasn1; View open source insights on deps.dev
Purl: pkg:pypi/pyasn1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.6.4

Affected versions

0.*

0.0.6a

0.0.9a

0.0.10a

0.0.11a

0.0.12a

0.0.13a

0.0.13b

0.0.13

0.1.1

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.1.7

0.1.8

0.1.9

0.2.1

0.2.2

0.2.3

0.3.1

0.3.2

0.3.3

0.3.4

0.3.5

0.3.6

0.3.7

0.4.1

0.4.2

0.4.3

0.4.4

0.4.5

0.4.6

0.4.7

0.4.8

0.5.0

0.5.1

0.6.0

0.6.1

0.6.2

0.6.3

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/pyasn1/PYSEC-2026-3455.yaml"