PYSEC-2026-3456

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/pyasn1/PYSEC-2026-3456.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-3456

Aliases

Published

2026-07-14T17:17:14.880Z

Modified

2026-07-22T11:00:08.814095424Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.

References

Affected packages

PyPI / pyasn1

Package

Name: pyasn1; View open source insights on deps.dev
Purl: pkg:pypi/pyasn1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.6.4

Affected versions

0.*

0.0.6a

0.0.9a

0.0.10a

0.0.11a

0.0.12a

0.0.13a

0.0.13b

0.0.13

0.1.1

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.1.7

0.1.8

0.1.9

0.2.1

0.2.2

0.2.3

0.3.1

0.3.2

0.3.3

0.3.4

0.3.5

0.3.6

0.3.7

0.4.1

0.4.2

0.4.3

0.4.4

0.4.5

0.4.6

0.4.7

0.4.8

0.5.0

0.5.1

0.6.0

0.6.1

0.6.2

0.6.3

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/pyasn1/PYSEC-2026-3456.yaml"