GHSA-M4P7-R5RC-7G4J

Vulnerability from github – Published: 2026-07-21 19:10 – Updated: 2026-07-21 19:10
VLAI
Summary
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
Details

Impact

The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.

Any application decoding untrusted BER/CER/DER input is affected.

Affected components

  • pyasn1.codec.ber.decoder — decode() and StreamingDecoder
  • pyasn1.codec.cer.decoder and pyasn1.codec.der.decoder, which inherit the same tag parsing
  • pyasn1.type.tag — Tag/TagSet reprs could raise ValueError when rendering oversized tag IDs (reachable through decoder error paths)

The encoders and the pyasn1.codec.native codec are not affected.

Patches

Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.

Workarounds

Bound the size of untrusted input passed to decode() before calling it.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.6.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pyssn1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59884"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T19:10:11Z",
    "nvd_published_at": "2026-07-14T17:17:14Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThe BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size \u2014 a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.\n\nAny application decoding untrusted BER/CER/DER input is affected.\n\n### Affected components\n- `pyasn1.codec.ber.decoder` \u2014 `decode()` and `StreamingDecoder`\n- `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit\n  the same tag parsing\n- `pyasn1.type.tag` \u2014 `Tag`/`TagSet` reprs could raise `ValueError` when\n  rendering oversized tag IDs (reachable through decoder error paths)\n\nThe encoders and the `pyasn1.codec.native` codec are not affected.\n\n### Patches\nFixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter\u0027s integer-to-string conversion limit.\n\n### Workarounds\nBound the size of untrusted input passed to `decode()` before calling it.",
  "id": "GHSA-m4p7-r5rc-7g4j",
  "modified": "2026-07-21T19:10:11Z",
  "published": "2026-07-21T19:10:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyasn1/pyasn1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.