chore(deps): update dependency pyasn1 to v0.6.4 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pyasn1 (changelog)	0.6.3 → 0.6.4

---

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

CVE-2026-59886 / GHSA-hm4w-wwcw-mr6r

More information

Details

Impact

The univ.Real type converted its (mantissa, base, exponent) value to a Python float using exact big-integer exponentiation. A BER/CER/DER-encoded REAL value only a few bytes long can carry a very large exponent, causing this computation to attempt to materialize an astronomically large integer.

Any operation that triggers float conversion on such a decoded value — prettyPrint(), str(), comparison, arithmetic, or an explicit float() call — consumes excessive CPU and memory, hanging the process. Applications that decode untrusted ASN.1 data and then print, log, or compare the decoded objects are vulnerable to denial of service. Decoding alone does not trigger the issue.

Affected components

• pyasn1.type.univ.Real — float conversion (float() and everything built on it: prettyPrint(), str(), comparisons, arithmetic, int())
• Reachable through the pyasn1.codec.ber, cer, and der decoders, which produce Real objects from untrusted input; also via directly constructed Real values

The encoders and the native codec are not affected. Applications that never handle ASN.1 REAL values are not affected.

Patches

Fixed in pyasn1 0.6.4. Binary (base-2) values are now converted with math.ldexp(), and decimal (base-10) values with exponents beyond float range raise OverflowError without constructing huge intermediate integers. Existing behavior is preserved: out-of-range values raise OverflowError and prettyPrint() renders them as .

Workarounds

Avoid converting, printing, or comparing decoded Real objects from untrusted sources; inspect the raw (mantissa, base, exponent) tuple instead.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r
• https://nvd.nist.gov/vuln/detail/CVE-2026-59886
• https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886
• https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4
• https://github.com/advisories/GHSA-hm4w-wwcw-mr6r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

CVE-2026-59885 / GHSA-8ppf-4f7h-5ppj

More information

Details

Impact

The BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload (tens of kilobytes) containing an OID with many arcs consumes seconds of CPU per decode() call, allowing denial of service in any application that decodes untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos, etc.). The corresponding encoders have the same quadratic behavior, reachable when an application re-encodes previously decoded attacker-supplied values.

The arc-size limit introduced for CVE-2026-23490 bounds the byte length of an individual arc but not the number of arcs, so it does not mitigate this issue.

Affected components

ObjectIdentifierPayloadDecoder and RelativeOIDPayloadDecoder in pyasn1/codec/ber/decoder.py; ObjectIdentifierEncoder and RelativeOIDEncoder in pyasn1/codec/ber/encoder.py. The CER and DER codecs inherit these and are equally affected.

Patches

Fixed in pyasn1 0.6.4: arc accumulation in both decoders and encoders now runs in linear time.

Workarounds

Limit the size of untrusted ASN.1 input before decoding.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj
• https://nvd.nist.gov/vuln/detail/CVE-2026-59885
• https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9
• https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4
• https://github.com/advisories/GHSA-8ppf-4f7h-5ppj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pyasn1/pyasn1 (pyasn1)

v0.6.4

Compare Source

• CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time
  complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders.
  A small crafted substrate encoding many arcs could consume
  excessive CPU. Arcs are now accumulated in linear time; decoded
  values are unchanged (thanks for reporting, tynus2)
• CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag
  IDs to 20 octets (140 bits), matching the OID arc limit introduced
  in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume
  excessive CPU and memory; longer tag IDs are now rejected with
  PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag
  (thanks for reporting, mikeappsec)
  IDs due to the integer-to-string conversion limit (Python 3.11+)
• CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and
  CPU consumption in Real.float() for values with large base-10
  exponents. Conversion no longer materializes huge intermediate
  integers; values too large to represent as a Python float raise
  OverflowError promptly, and prettyPrint() renders them as
  '' as before. Also fixed base-10 mantissa normalization
  to use exact integer arithmetic; mantissas larger than 2**53
  could previously lose precision through float division
  (thanks for reporting, gvozdila)
• Pinned PyPI publish GitHub Action to an immutable commit
  pr #​113

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud