Action not permitted
Modal body text goes here.
Modal Title
Modal Body
PYSEC-2026-3455
Vulnerability from pysec - Published: 2026-07-14 17:17 - Updated: 2026-07-22 09:57pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
| Name | purl | pyasn1 | pkg:pypi/pyasn1 |
|---|
{
"affected": [
{
"ecosystem_specific": {},
"package": {
"ecosystem": "PyPI",
"name": "pyasn1",
"purl": "pkg:pypi/pyasn1"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.10a",
"0.0.11a",
"0.0.12a",
"0.0.13",
"0.0.13a",
"0.0.13b",
"0.0.6a",
"0.0.9a",
"0.1.1",
"0.1.2",
"0.1.3",
"0.1.4",
"0.1.5",
"0.1.6",
"0.1.7",
"0.1.8",
"0.1.9",
"0.2.1",
"0.2.2",
"0.2.3",
"0.3.1",
"0.3.2",
"0.3.3",
"0.3.4",
"0.3.5",
"0.3.6",
"0.3.7",
"0.4.1",
"0.4.2",
"0.4.3",
"0.4.4",
"0.4.5",
"0.4.6",
"0.4.7",
"0.4.8",
"0.5.0",
"0.5.1",
"0.6.0",
"0.6.1",
"0.6.2",
"0.6.3"
]
}
],
"aliases": [
"CVE-2026-59884",
"GHSA-m4p7-r5rc-7g4j"
],
"details": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.",
"id": "PYSEC-2026-3455",
"modified": "2026-07-22T09:57:24.334467Z",
"published": "2026-07-14T17:17:14.750Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
},
{
"type": "ADVISORY",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
},
{
"type": "FIX",
"url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
BREW-ANSIBLE-CVE-2026-59884 (GHSA-M4P7-R5RC-7G4J)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-09-09 23:41 – Source websiteImpact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder—decode()andStreamingDecoderpyasn1.codec.cer.decoderandpyasn1.codec.der.decoder, which inherit the same tag parsingpyasn1.type.tag—Tag/TagSetreprs could raiseValueErrorwhen rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "pyasn1",
"resource_purl": "pkg:pypi/pyasn1@0.6.4",
"upstream_fixed_in": "0.6.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "ansible",
"purl": "pkg:brew/ansible"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pyasn1@0.6.4",
"name": "pyasn1",
"resource": "pyasn1",
"strategy": "registry",
"subject_version": "0.6.4"
}
]
},
"details": "### Impact\nThe BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size \u2014 a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.\n\nAny application decoding untrusted BER/CER/DER input is affected.\n\n### Affected components\n- `pyasn1.codec.ber.decoder` \u2014 `decode()` and `StreamingDecoder`\n- `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit\n the same tag parsing\n- `pyasn1.type.tag` \u2014 `Tag`/`TagSet` reprs could raise `ValueError` when\n rendering oversized tag IDs (reachable through decoder error paths)\n\nThe encoders and the `pyasn1.codec.native` codec are not affected.\n\n### Patches\nFixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter\u0027s integer-to-string conversion limit.\n\n### Workarounds\nBound the size of untrusted input passed to `decode()` before calling it.",
"id": "BREW-ansible-CVE-2026-59884",
"modified": "2026-09-09T23:41:05Z",
"published": "2026-08-13T16:35:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyasn1/pyasn1"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs",
"upstream": [
"GHSA-m4p7-r5rc-7g4j",
"CVE-2026-59884",
"PYSEC-2026-3455"
]
}
BREW-ANSIBLE@10-CVE-2026-59884 (GHSA-M4P7-R5RC-7G4J)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-09-09 23:41 – Source websiteImpact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder—decode()andStreamingDecoderpyasn1.codec.cer.decoderandpyasn1.codec.der.decoder, which inherit the same tag parsingpyasn1.type.tag—Tag/TagSetreprs could raiseValueErrorwhen rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "pyasn1",
"resource_purl": "pkg:pypi/pyasn1@0.6.1",
"upstream_fixed_in": "0.6.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "ansible@10",
"purl": "pkg:brew/ansible%4010"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pyasn1@0.6.1",
"name": "pyasn1",
"resource": "pyasn1",
"strategy": "registry",
"subject_version": "0.6.1"
}
]
},
"details": "### Impact\nThe BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size \u2014 a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.\n\nAny application decoding untrusted BER/CER/DER input is affected.\n\n### Affected components\n- `pyasn1.codec.ber.decoder` \u2014 `decode()` and `StreamingDecoder`\n- `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit\n the same tag parsing\n- `pyasn1.type.tag` \u2014 `Tag`/`TagSet` reprs could raise `ValueError` when\n rendering oversized tag IDs (reachable through decoder error paths)\n\nThe encoders and the `pyasn1.codec.native` codec are not affected.\n\n### Patches\nFixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter\u0027s integer-to-string conversion limit.\n\n### Workarounds\nBound the size of untrusted input passed to `decode()` before calling it.",
"id": "BREW-ansible@10-CVE-2026-59884",
"modified": "2026-09-09T23:41:06Z",
"published": "2026-08-13T16:35:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyasn1/pyasn1"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs",
"upstream": [
"GHSA-m4p7-r5rc-7g4j",
"CVE-2026-59884",
"PYSEC-2026-3455"
]
}
BREW-ANSIBLE@12-CVE-2026-59884 (GHSA-M4P7-R5RC-7G4J)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-09-09 23:41 – Source websiteImpact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder—decode()andStreamingDecoderpyasn1.codec.cer.decoderandpyasn1.codec.der.decoder, which inherit the same tag parsingpyasn1.type.tag—Tag/TagSetreprs could raiseValueErrorwhen rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "pyasn1",
"resource_purl": "pkg:pypi/pyasn1@0.6.1",
"upstream_fixed_in": "0.6.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "ansible@12",
"purl": "pkg:brew/ansible%4012"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pyasn1@0.6.1",
"name": "pyasn1",
"resource": "pyasn1",
"strategy": "registry",
"subject_version": "0.6.1"
}
]
},
"details": "### Impact\nThe BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size \u2014 a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.\n\nAny application decoding untrusted BER/CER/DER input is affected.\n\n### Affected components\n- `pyasn1.codec.ber.decoder` \u2014 `decode()` and `StreamingDecoder`\n- `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit\n the same tag parsing\n- `pyasn1.type.tag` \u2014 `Tag`/`TagSet` reprs could raise `ValueError` when\n rendering oversized tag IDs (reachable through decoder error paths)\n\nThe encoders and the `pyasn1.codec.native` codec are not affected.\n\n### Patches\nFixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter\u0027s integer-to-string conversion limit.\n\n### Workarounds\nBound the size of untrusted input passed to `decode()` before calling it.",
"id": "BREW-ansible@12-CVE-2026-59884",
"modified": "2026-09-09T23:41:06Z",
"published": "2026-08-13T16:35:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyasn1/pyasn1"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs",
"upstream": [
"GHSA-m4p7-r5rc-7g4j",
"CVE-2026-59884",
"PYSEC-2026-3455"
]
}
BREW-ANSIBLE@13-CVE-2026-59884 (GHSA-M4P7-R5RC-7G4J)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-09-17 19:52 – Source websiteImpact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder—decode()andStreamingDecoderpyasn1.codec.cer.decoderandpyasn1.codec.der.decoder, which inherit the same tag parsingpyasn1.type.tag—Tag/TagSetreprs could raiseValueErrorwhen rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "pyasn1",
"resource_purl": "pkg:pypi/pyasn1@0.6.4",
"upstream_fixed_in": "0.6.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "ansible@13",
"purl": "pkg:brew/ansible%4013"
},
"ranges": [
{
"events": [
{
"introduced": "13.7.0"
},
{
"fixed": "13.8.0_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pyasn1@0.6.4",
"name": "pyasn1",
"resource": "pyasn1",
"strategy": "registry",
"subject_version": "0.6.4"
}
]
},
"details": "### Impact\nThe BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size \u2014 a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.\n\nAny application decoding untrusted BER/CER/DER input is affected.\n\n### Affected components\n- `pyasn1.codec.ber.decoder` \u2014 `decode()` and `StreamingDecoder`\n- `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit\n the same tag parsing\n- `pyasn1.type.tag` \u2014 `Tag`/`TagSet` reprs could raise `ValueError` when\n rendering oversized tag IDs (reachable through decoder error paths)\n\nThe encoders and the `pyasn1.codec.native` codec are not affected.\n\n### Patches\nFixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter\u0027s integer-to-string conversion limit.\n\n### Workarounds\nBound the size of untrusted input passed to `decode()` before calling it.",
"id": "BREW-ansible@13-CVE-2026-59884",
"modified": "2026-09-17T19:52:58Z",
"published": "2026-08-13T16:35:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyasn1/pyasn1"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs",
"upstream": [
"GHSA-m4p7-r5rc-7g4j",
"CVE-2026-59884",
"PYSEC-2026-3455"
]
}
BREW-ANSIBLE@9-CVE-2026-59884 (GHSA-M4P7-R5RC-7G4J)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:35 – Updated: 2026-09-09 23:41 – Source websiteImpact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder—decode()andStreamingDecoderpyasn1.codec.cer.decoderandpyasn1.codec.der.decoder, which inherit the same tag parsingpyasn1.type.tag—Tag/TagSetreprs could raiseValueErrorwhen rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "pyasn1",
"resource_purl": "pkg:pypi/pyasn1@0.6.1",
"upstream_fixed_in": "0.6.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "ansible@9",
"purl": "pkg:brew/ansible%409"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pyasn1@0.6.1",
"name": "pyasn1",
"resource": "pyasn1",
"strategy": "registry",
"subject_version": "0.6.1"
}
]
},
"details": "### Impact\nThe BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size \u2014 a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.\n\nAny application decoding untrusted BER/CER/DER input is affected.\n\n### Affected components\n- `pyasn1.codec.ber.decoder` \u2014 `decode()` and `StreamingDecoder`\n- `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit\n the same tag parsing\n- `pyasn1.type.tag` \u2014 `Tag`/`TagSet` reprs could raise `ValueError` when\n rendering oversized tag IDs (reachable through decoder error paths)\n\nThe encoders and the `pyasn1.codec.native` codec are not affected.\n\n### Patches\nFixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter\u0027s integer-to-string conversion limit.\n\n### Workarounds\nBound the size of untrusted input passed to `decode()` before calling it.",
"id": "BREW-ansible@9-CVE-2026-59884",
"modified": "2026-09-09T23:41:06Z",
"published": "2026-08-13T16:35:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyasn1/pyasn1"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs",
"upstream": [
"GHSA-m4p7-r5rc-7g4j",
"CVE-2026-59884",
"PYSEC-2026-3455"
]
}
BREW-AWS-SHELL-CVE-2026-59884 (GHSA-M4P7-R5RC-7G4J)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:37 – Updated: 2026-09-09 23:42 – Source websiteImpact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder—decode()andStreamingDecoderpyasn1.codec.cer.decoderandpyasn1.codec.der.decoder, which inherit the same tag parsingpyasn1.type.tag—Tag/TagSetreprs could raiseValueErrorwhen rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "pyasn1",
"resource_purl": "pkg:pypi/pyasn1@0.6.4",
"upstream_fixed_in": "0.6.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "aws-shell",
"purl": "pkg:brew/aws-shell"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.2_15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pyasn1@0.6.4",
"name": "pyasn1",
"resource": "pyasn1",
"strategy": "registry",
"subject_version": "0.6.4"
}
]
},
"details": "### Impact\nThe BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size \u2014 a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.\n\nAny application decoding untrusted BER/CER/DER input is affected.\n\n### Affected components\n- `pyasn1.codec.ber.decoder` \u2014 `decode()` and `StreamingDecoder`\n- `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit\n the same tag parsing\n- `pyasn1.type.tag` \u2014 `Tag`/`TagSet` reprs could raise `ValueError` when\n rendering oversized tag IDs (reachable through decoder error paths)\n\nThe encoders and the `pyasn1.codec.native` codec are not affected.\n\n### Patches\nFixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter\u0027s integer-to-string conversion limit.\n\n### Workarounds\nBound the size of untrusted input passed to `decode()` before calling it.",
"id": "BREW-aws-shell-CVE-2026-59884",
"modified": "2026-09-09T23:42:43Z",
"published": "2026-08-13T16:37:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyasn1/pyasn1"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs",
"upstream": [
"GHSA-m4p7-r5rc-7g4j",
"CVE-2026-59884",
"PYSEC-2026-3455"
]
}
BREW-AWSCLI@1-CVE-2026-59884 (GHSA-M4P7-R5RC-7G4J)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:37 – Updated: 2026-09-17 19:06 – Source websiteImpact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder—decode()andStreamingDecoderpyasn1.codec.cer.decoderandpyasn1.codec.der.decoder, which inherit the same tag parsingpyasn1.type.tag—Tag/TagSetreprs could raiseValueErrorwhen rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "pyasn1",
"resource_purl": "pkg:pypi/pyasn1@0.6.4",
"upstream_fixed_in": "0.6.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "awscli@1",
"purl": "pkg:brew/awscli%401"
},
"ranges": [
{
"events": [
{
"introduced": "1.20.20"
},
{
"fixed": "1.45.50"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pyasn1@0.6.4",
"name": "pyasn1",
"resource": "pyasn1",
"strategy": "registry",
"subject_version": "0.6.4"
}
]
},
"details": "### Impact\nThe BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size \u2014 a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.\n\nAny application decoding untrusted BER/CER/DER input is affected.\n\n### Affected components\n- `pyasn1.codec.ber.decoder` \u2014 `decode()` and `StreamingDecoder`\n- `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit\n the same tag parsing\n- `pyasn1.type.tag` \u2014 `Tag`/`TagSet` reprs could raise `ValueError` when\n rendering oversized tag IDs (reachable through decoder error paths)\n\nThe encoders and the `pyasn1.codec.native` codec are not affected.\n\n### Patches\nFixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter\u0027s integer-to-string conversion limit.\n\n### Workarounds\nBound the size of untrusted input passed to `decode()` before calling it.",
"id": "BREW-awscli@1-CVE-2026-59884",
"modified": "2026-09-17T19:06:12Z",
"published": "2026-08-13T16:37:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyasn1/pyasn1"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs",
"upstream": [
"GHSA-m4p7-r5rc-7g4j",
"CVE-2026-59884",
"PYSEC-2026-3455"
]
}
BREW-CERTSYNC-CVE-2026-59884 (GHSA-M4P7-R5RC-7G4J)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:39 – Updated: 2026-09-09 23:45 – Source websiteImpact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder—decode()andStreamingDecoderpyasn1.codec.cer.decoderandpyasn1.codec.der.decoder, which inherit the same tag parsingpyasn1.type.tag—Tag/TagSetreprs could raiseValueErrorwhen rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": null,
"range_state": "affected",
"resource": "pyasn1",
"resource_purl": "pkg:pypi/pyasn1@0.4.8",
"upstream_fixed_in": "0.6.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "certsync",
"purl": "pkg:brew/certsync"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pyasn1@0.4.8",
"name": "pyasn1",
"resource": "pyasn1",
"strategy": "registry",
"subject_version": "0.4.8"
}
]
},
"details": "### Impact\nThe BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size \u2014 a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.\n\nAny application decoding untrusted BER/CER/DER input is affected.\n\n### Affected components\n- `pyasn1.codec.ber.decoder` \u2014 `decode()` and `StreamingDecoder`\n- `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit\n the same tag parsing\n- `pyasn1.type.tag` \u2014 `Tag`/`TagSet` reprs could raise `ValueError` when\n rendering oversized tag IDs (reachable through decoder error paths)\n\nThe encoders and the `pyasn1.codec.native` codec are not affected.\n\n### Patches\nFixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter\u0027s integer-to-string conversion limit.\n\n### Workarounds\nBound the size of untrusted input passed to `decode()` before calling it.",
"id": "BREW-certsync-CVE-2026-59884",
"modified": "2026-09-09T23:45:59Z",
"published": "2026-08-13T16:39:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyasn1/pyasn1"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs",
"upstream": [
"GHSA-m4p7-r5rc-7g4j",
"CVE-2026-59884",
"PYSEC-2026-3455"
]
}
BREW-CVE-BIN-TOOL-CVE-20… (GHSA-M4P7-R5RC-7G4J)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:42 – Updated: 2026-09-17 18:43 – Source websiteImpact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder—decode()andStreamingDecoderpyasn1.codec.cer.decoderandpyasn1.codec.der.decoder, which inherit the same tag parsingpyasn1.type.tag—Tag/TagSetreprs could raiseValueErrorwhen rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "pyasn1",
"resource_purl": "pkg:pypi/pyasn1@0.6.4",
"upstream_fixed_in": "0.6.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "cve-bin-tool",
"purl": "pkg:brew/cve-bin-tool"
},
"ranges": [
{
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pyasn1@0.6.4",
"name": "pyasn1",
"resource": "pyasn1",
"strategy": "registry",
"subject_version": "0.6.4"
}
]
},
"details": "### Impact\nThe BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size \u2014 a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.\n\nAny application decoding untrusted BER/CER/DER input is affected.\n\n### Affected components\n- `pyasn1.codec.ber.decoder` \u2014 `decode()` and `StreamingDecoder`\n- `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit\n the same tag parsing\n- `pyasn1.type.tag` \u2014 `Tag`/`TagSet` reprs could raise `ValueError` when\n rendering oversized tag IDs (reachable through decoder error paths)\n\nThe encoders and the `pyasn1.codec.native` codec are not affected.\n\n### Patches\nFixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter\u0027s integer-to-string conversion limit.\n\n### Workarounds\nBound the size of untrusted input passed to `decode()` before calling it.",
"id": "BREW-cve-bin-tool-CVE-2026-59884",
"modified": "2026-09-17T18:43:45Z",
"published": "2026-08-13T16:42:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyasn1/pyasn1"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs",
"upstream": [
"GHSA-m4p7-r5rc-7g4j",
"CVE-2026-59884",
"PYSEC-2026-3455"
]
}
BREW-DSTACK-CVE-2026-59884 (GHSA-M4P7-R5RC-7G4J)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:43 – Updated: 2026-09-17 18:14 – Source websiteImpact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder—decode()andStreamingDecoderpyasn1.codec.cer.decoderandpyasn1.codec.der.decoder, which inherit the same tag parsingpyasn1.type.tag—Tag/TagSetreprs could raiseValueErrorwhen rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "pyasn1",
"resource_purl": "pkg:pypi/pyasn1@0.6.4",
"upstream_fixed_in": "0.6.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "dstack",
"purl": "pkg:brew/dstack"
},
"ranges": [
{
"events": [
{
"introduced": "0.2"
},
{
"fixed": "0.20.27"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/pyasn1@0.6.4",
"name": "pyasn1",
"resource": "pyasn1",
"strategy": "registry",
"subject_version": "0.6.4"
}
]
},
"details": "### Impact\nThe BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size \u2014 a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling.\n\nAny application decoding untrusted BER/CER/DER input is affected.\n\n### Affected components\n- `pyasn1.codec.ber.decoder` \u2014 `decode()` and `StreamingDecoder`\n- `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit\n the same tag parsing\n- `pyasn1.type.tag` \u2014 `Tag`/`TagSet` reprs could raise `ValueError` when\n rendering oversized tag IDs (reachable through decoder error paths)\n\nThe encoders and the `pyasn1.codec.native` codec are not affected.\n\n### Patches\nFixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter\u0027s integer-to-string conversion limit.\n\n### Workarounds\nBound the size of untrusted input passed to `decode()` before calling it.",
"id": "BREW-dstack-CVE-2026-59884",
"modified": "2026-09-17T18:14:18Z",
"published": "2026-08-13T16:43:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyasn1/pyasn1"
},
{
"type": "WEB",
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs",
"upstream": [
"GHSA-m4p7-r5rc-7g4j",
"CVE-2026-59884",
"PYSEC-2026-3455"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.