Description
pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pyasn1 | pyasn1 | >= 0.3.3, < 0.6.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pyasn1 | 0.6.5-1 | — |
| Debian 13 | pyasn1 | No fix yet | — |
| Debian 12 | pyasn1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | pyasn1 | 0.6.4-1ubuntu0.1 | USN-9011-1 |
| Ubuntu 26.04 LTS | pyasn1 | 0.6.3-1ubuntu0.2 | USN-9011-1 |
| Ubuntu 24.04 LTS | pyasn1 | 0.4.8-4ubuntu0.4 | USN-9011-1 |
| Ubuntu 22.04 LTS | pyasn1 | 0.4.8-1ubuntu0.4 | USN-9011-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | pyasn1 | 0.4.2-3ubuntu0.20.04.1~esm2 | USN-9011-1 |
| Ubuntu Pro 18.04 LTS | pyasn1 | 0.4.2-3ubuntu0.18.04.1~esm2 | USN-9011-1 |
| Ubuntu Pro 16.04 LTS | pyasn1 | 0.1.9-1ubuntu0.1~esm2 | USN-9011-1 |
| Ubuntu Pro 14.04 LTS | pyasn1 | 0.1.7-1ubuntu2.1+esm2 | USN-9011-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-pyasn1 | 0.6.5-1.1 | openSUSE-SU-2026:12491-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-pyasn1 +2 | 0.4.8-4.amzn2023.0.6 | ALAS2023-2026-3438 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-pyasn1 | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubeflow-pipelines-apiserver | 2.18.0-r1 | — |
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.18.0-r2 | — |
| Wolfi rolling | superset-6.0 | No fix yet | — |
| Wolfi rolling | superset-6.1 | 6.1.0-r24 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pyasn1 | >= 0.3.3, < 0.6.5 | 0.6.5 | GHSA-fm9c-5rcf-2q5p |
Advisories 3
- ALAS2023-2026-3438 Important: python-pyasn1 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- USN-9011-1 pyasn1 vulnerabilities Ubuntu Security Notices (USN) · Nov 11, 2026
- openSUSE-SU-2026:12491-1 python313-pyasn1-0.6.5-1.1 on GA media SUSE / openSUSE Security Updates · Nov 9, 2026