Skip to content

Update dependency pyasn1 to v0.6.4 [SECURITY] - #158

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/pypi-pyasn1-vulnerability
Open

Update dependency pyasn1 to v0.6.4 [SECURITY]#158
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/pypi-pyasn1-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Mar 17, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
pyasn1 (changelog) ==0.4.8 → ==0.6.4 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Denial of Service in pyasn1 via Unbounded Recursion

CVE-2026-30922 / GHSA-jr27-m4p2-rc6r

More information

Details

Summary

The pyasn1 library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.

Details

The vulnerability exists because the decoder iterates through the input stream and recursively calls decodeFun (the decoding callback) for every nested component found, without tracking or limiting the recursion depth.
Vulnerable Code Locations:

  1. indefLenValueDecoder (Line 998):
    for component in decodeFun(substrate, asn1Spec, allowEoo=True, **options):
    This method handles indefinite-length constructed types. It sits inside a while True loop and recursively calls the decoder for every nested tag.

  2. valueDecoder (Lines 786 and 907):
    for component in decodeFun(substrate, componentType, **options):
    This method handles standard decoding when a schema is present. It contains two distinct recursive calls that lack depth checks: Line 786: Recursively decodes components of SEQUENCE or SET types. Line 907: Recursively decodes elements of SEQUENCE OF or SET OF types.

  3. _decodeComponentsSchemaless (Line 661):
    for component in decodeFun(substrate, **options):
    This method handles decoding when no schema is provided.

In all three cases, decodeFun is invoked without passing a depth parameter or checking against a global MAX_ASN1_NESTING limit.

PoC
import sys
from pyasn1.codec.ber import decoder

sys.setrecursionlimit(100000)

print("[*] Generating Recursion Bomb Payload...")
depth = 50_000
chunk = b'\x30\x80' 
payload = chunk * depth

print(f"[*] Payload size: {len(payload) / 1024:.2f} KB")
print("[*] Triggering Decoder...")

try:
    decoder.decode(payload)
except RecursionError:
    print("[!] Crashed: Recursion Limit Hit")
except MemoryError:
    print("[!] Crashed: Out of Memory")
except Exception as e:
    print(f"[!] Crashed: {e}")

[*] Payload size: 9.77 KB
[*] Triggering Decoder...
[!] Crashed: Recursion Limit Hit
Impact
  • This is an unhandled runtime exception that typically terminates the worker process or thread handling the request. This allows a remote attacker to trivially kill service workers with a small payload (<100KB), resulting in a Denial of Service. Furthermore, in environments where recursion limits are increased, this leads to server-wide memory exhaustion.
  • Service Crash: Any service using pyasn1 to parse untrusted ASN.1 data (e.g., LDAP, SNMP, Kerberos, X.509 parsers) can be crashed remotely.
  • Resource Exhaustion: The attack consumes RAM linearly with the nesting depth. A small payload (<200KB) can consume hundreds of megabytes of RAM or exhaust the stack.
Credits

Vulnerability discovered by Kevin Tu of TMIR at ByteDance.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

CVE-2026-59886 / GHSA-hm4w-wwcw-mr6r

More information

Details

Impact

The univ.Real type converted its (mantissa, base, exponent) value to a Python float using exact big-integer exponentiation. A BER/CER/DER-encoded REAL value only a few bytes long can carry a very large exponent, causing this computation to attempt to materialize an astronomically large integer.

Any operation that triggers float conversion on such a decoded value — prettyPrint(), str(), comparison, arithmetic, or an explicit float() call — consumes excessive CPU and memory, hanging the process. Applications that decode untrusted ASN.1 data and then print, log, or compare the decoded objects are vulnerable to denial of service. Decoding alone does not trigger the issue.

Affected components
  • pyasn1.type.univ.Real — float conversion (float() and everything built on it: prettyPrint(), str(), comparisons, arithmetic, int())
  • Reachable through the pyasn1.codec.ber, cer, and der decoders, which produce Real objects from untrusted input; also via directly constructed Real values

The encoders and the native codec are not affected. Applications that never handle ASN.1 REAL values are not affected.

Patches

Fixed in pyasn1 0.6.4. Binary (base-2) values are now converted with math.ldexp(), and decimal (base-10) values with exponents beyond float range raise OverflowError without constructing huge intermediate integers. Existing behavior is preserved: out-of-range values raise OverflowError and prettyPrint() renders them as .

Workarounds

Avoid converting, printing, or comparing decoded Real objects from untrusted sources; inspect the raw (mantissa, base, exponent) tuple instead.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

CVE-2026-59885 / GHSA-8ppf-4f7h-5ppj

More information

Details

Impact

The BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload (tens of kilobytes) containing an OID with many arcs consumes seconds of CPU per decode() call, allowing denial of service in any application that decodes untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos, etc.). The corresponding encoders have the same quadratic behavior, reachable when an application re-encodes previously decoded attacker-supplied values.

The arc-size limit introduced for CVE-2026-23490 bounds the byte length of an individual arc but not the number of arcs, so it does not mitigate this issue.

Affected components

ObjectIdentifierPayloadDecoder and RelativeOIDPayloadDecoder in pyasn1/codec/ber/decoder.py; ObjectIdentifierEncoder and RelativeOIDEncoder in pyasn1/codec/ber/encoder.py. The CER and DER codecs inherit these and are equally affected.

Patches

Fixed in pyasn1 0.6.4: arc accumulation in both decoders and encoders now runs in linear time.

Workarounds

Limit the size of untrusted ASN.1 input before decoding.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

pyasn1/pyasn1 (pyasn1)

v0.6.4

Compare Source

  • CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time
    complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders.
    A small crafted substrate encoding many arcs could consume
    excessive CPU. Arcs are now accumulated in linear time; decoded
    values are unchanged (thanks for reporting, tynus2)
  • CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag
    IDs to 20 octets (140 bits), matching the OID arc limit introduced
    in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume
    excessive CPU and memory; longer tag IDs are now rejected with
    PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag
    (thanks for reporting, mikeappsec)
    IDs due to the integer-to-string conversion limit (Python 3.11+)
  • CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and
    CPU consumption in Real.float() for values with large base-10
    exponents. Conversion no longer materializes huge intermediate
    integers; values too large to represent as a Python float raise
    OverflowError promptly, and prettyPrint() renders them as
    '' as before. Also fixed base-10 mantissa normalization
    to use exact integer arithmetic; mantissas larger than 2**53
    could previously lose precision through float division
    (thanks for reporting, gvozdila)
  • Pinned PyPI publish GitHub Action to an immutable commit
    pr #​113

v0.6.3

Compare Source

v0.6.2

Compare Source

v0.6.1

Compare Source

v0.6.0

Compare Source

  • Added support for previously missing RELATIVE-OID construct
    pr #​48
  • Updated link to Layman's Guide
    Now it provides a link to links to a formatted PDF version of the paper,
    at a stable domain (researchgate), using https
    pr #​50
  • Removed support for EOL Python 2.7, 3.6, 3.7
    pr #​56

v0.5.1

Compare Source

  • Added support for PyPy 3.10 and Python 3.12
    pr #​32

  • Updated RTD configuration to include a dummy index.rst
    redirecting to contents.html, ensuring compatibility with
    third-party documentation and search indexes.
    pr #​47

  • Fixed the API breakage wih decoder.decode(substrateFun=...).

    A substrateFun passed to decoder.decode() can now be either
    v0.4 Non-Streaming or v0.5 Streaming. pyasn1 will detect and
    handle both cases transparently.

    A substrateFun passed to one of the new streaming decoders is
    still expected to be v0.5 Streaming only.
    pr #​30
    pr #​39

v0.5.0

Compare Source

  • Change RealEncoder.supportIndefLenMode type to a boolean
    pr #​21

  • Fix CI for py39 test environment
    pr #​25

  • Replace all snmplabs.com links
    issue #​4

  • Use correct SPDX identifier for the license
    pr #​16

  • Re-add tagMap and typeMap module level attributes to all
    encoder and decoder modules. They are aliases for TAG_MAP and
    TYPE_MAP, issue #​9.

  • Restore API for passing for tagMap and typeMap arguments
    to Encoder and Decoder classes by name and position,
    issue #​12.

  • Re-add tagMap and typeMap module level attributes to all
    encoder and decoder modules. They are aliases for TAG_MAP and
    TYPE_MAP, issue #​9.

  • Restore API for passing for tagMap and typeMap arguments
    to Encoder and Decoder classes by name and position,

  • Make BER/CER/DER decoders streaming and suspendible

    The goal of this change is to make the decoder yielding on input
    data starvation and resuming from where it stopped whenever the
    caller decides to try again (hopefully making sure that some more
    input becomes available).

    This change makes it possible for the decoder to operate on streams
    of data (meaning that the entire DER blob might not be immediately
    available on input).

    On top of that, the decoder yields partially reconstructed ASN.1
    object on input starvation making it possible for the caller to
    inspect what has been decoded so far and possibly consume partial
    ASN.1 data.

    All these new feature are natively available through
    StreamingDecoder class. Previously published API is implemented
    as a thin wrapper on top of that ensuring backward compatibility.

  • Added support for Python 3.8, 3.9, 3.10, 3.11

  • Removed support for EOL Pythons 2.4, 2.5, 2.6, 3.2, 3.3, 3.4, 3.5

  • Added support for PyPy 3.7, 3.8, 3.9

  • Modernized packaging and testing. pyasn1 now uses setup.cfg,
    pyproject.toml, build, and
    GitHub Actions.

  • PyPI package ownership for pyasn1 and pyasn1-module has been
    transfered to Christian Heimes and Simon Pichugin in
    PyPI support ticket #​2090.

  • The upstream repositories for pyasn1 and pyasn1-modules are now
    in the GitHub organization https://github.com/pyasn1/.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title Update dependency pyasn1 to v0.6.3 [SECURITY] Update dependency pyasn1 to v0.6.3 [SECURITY] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate
renovate Bot deleted the renovate/pypi-pyasn1-vulnerability branch March 27, 2026 01:27
@renovate renovate Bot changed the title Update dependency pyasn1 to v0.6.3 [SECURITY] - autoclosed Update dependency pyasn1 to v0.6.3 [SECURITY] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate
renovate Bot force-pushed the renovate/pypi-pyasn1-vulnerability branch 2 times, most recently from fb6e308 to 5c1991e Compare March 30, 2026 18:33
@renovate renovate Bot changed the title Update dependency pyasn1 to v0.6.3 [SECURITY] Update dependency pyasn1 to v0.6.3 [SECURITY] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title Update dependency pyasn1 to v0.6.3 [SECURITY] - autoclosed Update dependency pyasn1 to v0.6.3 [SECURITY] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate
renovate Bot force-pushed the renovate/pypi-pyasn1-vulnerability branch 2 times, most recently from 5c1991e to 5d44610 Compare April 27, 2026 23:27
@renovate renovate Bot changed the title Update dependency pyasn1 to v0.6.3 [SECURITY] Update dependency pyasn1 to v0.6.3 [SECURITY] - autoclosed May 29, 2026
@renovate renovate Bot closed this May 29, 2026
@renovate renovate Bot changed the title Update dependency pyasn1 to v0.6.3 [SECURITY] - autoclosed Update dependency pyasn1 to v0.6.3 [SECURITY] May 30, 2026
@renovate renovate Bot reopened this May 30, 2026
@renovate
renovate Bot force-pushed the renovate/pypi-pyasn1-vulnerability branch from 5d44610 to b2c434c Compare May 30, 2026 00:50
@renovate renovate Bot changed the title Update dependency pyasn1 to v0.6.3 [SECURITY] Update dependency pyasn1 to v0.6.4 [SECURITY] Jul 23, 2026
@renovate
renovate Bot force-pushed the renovate/pypi-pyasn1-vulnerability branch from b2c434c to 053023a Compare July 23, 2026 23:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants