A malformed RELATIVE-OID containing excessive continuation octets can cause the pyasn1 decoder to allocate large amounts of memory, leading to a denial of service. This is a CWE‑770 issue – Excessive Resource Consumption – affecting releases prior to 0.6.2 and fixed in 0.6.2. A successful exploitation would exhaust system memory, potentially halting a Python process or system component that relies on pyasn1.

The vulnerability affects the pyasn1 package for Python, specifically any installations using a version earlier than 0.6.2. Debian 11.0 packages that ship the older library are also impacted, as noted in the Debian LTS announcement. Any host or service that imports pyasn1 and processes input ASN.1 data could be exposed.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply or otherwise influence the malformed data that triggers memory exhaustion; the exact attack vector depends on the application’s use of pyasn1 and is inferred rather than explicitly provided.