Denial-of-Service Vulnerability in pyasn1: Memory Exhaustion from Malformed OIDs
Summary
GHSA-63vm-454h-vhhq: pyasn1 has a DoS vulnerability in decoder. Affects pyasn1 versions >= 0.6.1, < 0.6.2. Fixed in 0.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pyasn1 is a pure-Python implementation of ASN.1 (Abstract Syntax Notation One) data structures, widely used for encoding and decoding data in various protocols, including network communications and cryptographic applications. The library is essential for applications that require data serialization and deserialization, particularly in security contexts like TLS/SSL. However, a vulnerability has been identified in version 0.6.1 that can lead to significant memory exhaustion when processing malformed RELATIVE-OID inputs.
Vulnerability Detail
The vulnerability arises from a Denial-of-Service (DoS) issue in the decoder component of pyasn1, specifically in the handling of RELATIVE-OID with excessive continuation octets. The problematic line of code, 'reloid += ((subId << 7) + nextSubId,)', can cause the decoder to enter a loop that consumes excessive memory, potentially leading to application crashes or system hangs. This vulnerability can be exploited by attackers who craft malicious X.509 certificates, which, when processed by applications using pyasn1, can exhaust system resources and disrupt service availability.
How To Fix
Latest published version: 0.6.4 as of 22 Oct 2026
pip install --upgrade "pyasn1==0.6.4"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.2
This is the first release that contains the fix.
pip install --upgrade "pyasn1==0.6.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement input validation to limit the size of the OID inputs processed by the decoder. This can help mitigate the risk of memory exhaustion until the package is updated. Here is a sample code snippet to limit input size:
import pyasn1.codec.ber.decoder as decoder import pyasn1.type.univ as univ
def safe_decode(malicious_packet):
if len(malicious_packet) > 1024 * 1024: # Limit to 1MB
raise ValueError('Input packet too large')
return decoder.decode(malicious_packet, asn1Spec=univ.ObjectIdentifier())
Conclusion
The identified Denial-of-Service vulnerability in pyasn1 poses a significant risk to applications that process malformed OIDs. It is crucial to update to the patched version to mitigate this risk. Additionally, implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for pyasn1 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerability can lead to resource exhaustion, causing applications to hang or crash, affecting services like LDAP servers, TLS/SSL endpoints, and OCSP responders.
Yes, the vulnerability has been patched in version 0.6.2 of pyasn1. It is recommended to update to this version or later.
If immediate updates are not possible, implement input validation to limit the size of OID inputs processed by the decoder as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyasn1.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
