Impact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling.
Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder — decode() and StreamingDecoderpyasn1.codec.cer.decoder and pyasn1.codec.der.decoder, which inherit
the same tag parsingpyasn1.type.tag — Tag/TagSet reprs could raise ValueError when
rendering oversized tag IDs (reachable through decoder error paths)
The encoders and the pyasn1.codec.native codec are not affected.
Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.
Workarounds
Bound the size of untrusted input passed to decode() before calling it.
References
mikeappsec Reporter
Impact
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled
ValueError(integer string conversion limit) while the decoder formats error messages, violating the documentedPyAsn1Errorcontract and potentially bypassing caller error handling.Any application decoding untrusted BER/CER/DER input is affected.
Affected components
pyasn1.codec.ber.decoder—decode()andStreamingDecoderpyasn1.codec.cer.decoderandpyasn1.codec.der.decoder, which inheritthe same tag parsing
pyasn1.type.tag—Tag/TagSetreprs could raiseValueErrorwhenrendering oversized tag IDs (reachable through decoder error paths)
The encoders and the
pyasn1.codec.nativecodec are not affected.Patches
Fixed in 0.6.4. Long-form tag IDs are now limited to 20 octets (140-bit tag IDs, matching the existing OID arc limit); oversized tags are rejected with
PyAsn1Error. Tag ID rendering in reprs and error messages was additionally hardened against the interpreter's integer-to-string conversion limit.Workarounds
Bound the size of untrusted input passed to
decode()before calling it.References