Issue

Certain patterns of indefinite length encodings in BER data could cause quadratic behavior in the parser, resulting in a denial of service. Up until Botan 3.12.0, such BER encodings were accepted even in structures which are required to be encoded as DER, which prohibits indefinite length encodings.

Impact

Any party which can send any ASN.1 encoded data (such as an X509 certificate or OCSP response) can induce CPU based denial of service.

Credit

Found by Yt Sun