GHSA-m4p7-r5rc-7g4j

Dashboard / Vulnerabilities / GHSA-m4p7-r5rc-7g4j

GHSA-m4p7-r5rc-7g4j

Summary: pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

Details: ### Impact The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled `ValueError` (integer string conversion limit) while the decoder formats error messages, violating the documented `PyAsn1Error` contract and potentially bypassing caller error handling. Any application decoding untrusted BER/CER/DER input is affected. ### Affected components - `pyasn1.codec.ber.decoder` — `decode()` and `StreamingDecoder` - `pyasn1.codec.cer.decoder` and `pyasn1.codec.der.decoder`, which inherit the same tag parsing - `pyasn1.type.tag` — `Tag`/`TagSet` reprs could raise `ValueError` when rendering oversized tag IDs (reachable through decoder error paths) The encoders and the `pyasn1.codec.native` codec are not affected. ### Patches Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with `PyAsn1Error`. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit. ### Workarounds Bound the size of untrusted input passed to `decode()` before calling it.

References: https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j, https://nvd.nist.gov/vuln/detail/CVE-2026-59884, https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5, https://github.com/pyasn1/pyasn1, https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4, https://github.com/pypa/advisory-database/tree/main/vulns/pyasn1/PYSEC-2026-3455.yaml