GHSA-hm4w-wwcw-mr6r

Suggest an improvement
Source
https://github.com/advisories/GHSA-hm4w-wwcw-mr6r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-hm4w-wwcw-mr6r/GHSA-hm4w-wwcw-mr6r.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-hm4w-wwcw-mr6r
Aliases
Downstream
CGA (126)
ECHO (1)
MINI (26)
Published
2026-07-21T19:11:20Z
Modified
2026-07-22T11:15:27Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
Details

Impact

The univ.Real type converted its (mantissa, base, exponent) value to a Python float using exact big-integer exponentiation. A BER/CER/DER-encoded REAL value only a few bytes long can carry a very large exponent, causing this computation to attempt to materialize an astronomically large integer.

Any operation that triggers float conversion on such a decoded value — prettyPrint(), str(), comparison, arithmetic, or an explicit float() call — consumes excessive CPU and memory, hanging the process. Applications that decode untrusted ASN.1 data and then print, log, or compare the decoded objects are vulnerable to denial of service. Decoding alone does not trigger the issue.

Affected components

  • pyasn1.type.univ.Real — float conversion (float() and everything built on it: prettyPrint(), str(), comparisons, arithmetic, int())
  • Reachable through the pyasn1.codec.ber, cer, and der decoders, which produce Real objects from untrusted input; also via directly constructed Real values

The encoders and the native codec are not affected. Applications that never handle ASN.1 REAL values are not affected.

Patches

Fixed in pyasn1 0.6.4. Binary (base-2) values are now converted with math.ldexp(), and decimal (base-10) values with exponents beyond float range raise OverflowError without constructing huge intermediate integers. Existing behavior is preserved: out-of-range values raise OverflowError and prettyPrint() renders them as .

Workarounds

Avoid converting, printing, or comparing decoded Real objects from untrusted sources; inspect the raw (mantissa, base, exponent) tuple instead.

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T19:11:20Z",
    "nvd_published_at": "2026-07-14T17:17:15Z",
    "severity": "HIGH"
}
References

Affected packages

PyPI / pyasn1

Package

Name
pyasn1
View open source insights on deps.dev
Purl
pkg:pypi/pyasn1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.6.4

Affected versions

0.*
0.0.6a
0.0.9a
0.0.10a
0.0.11a
0.0.12a
0.0.13a
0.0.13b
0.0.13
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.1
0.2.2
0.2.3
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3

Database specific

last_known_affected_version_range 
"<= 0.6.3"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-hm4w-wwcw-mr6r/GHSA-hm4w-wwcw-mr6r.json"