HIGH 7.5
PYSEC-2026-3455
Quick fix
PYSEC-2026-3455 — pyasn1: upgrade to the fixed version with the command below.
pip install --upgrade 'pyasn1>=0.6.4'Details
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4.
Are you affected?
Enter the version of the package you're using.