The vulnerability resides in the ASN.1 decoder of the pyasn1 library. When decoding data that contains thousands of nested SEQUENCE or SET tags marked with an indefinite length marker, the decoder recurses without bounds. This uncontrolled recursion can cause the Python interpreter to raise a RecursionError or exhaust all available memory, leading the host application to crash. The result is a functional denial of service. The weakness is a classic unchecked recursion, reflected by CWE-674 and CWE-835.

The pyasn1 library for Python is affected. Versions earlier than 0.6.3 are vulnerable. The code base is typically used in applications that process ASN.1 data, such as network protocol implementations, certificate handling, or other security components. Any application that imports and uses pyasn1 for decoding potentially exposed input is at risk.

The CVSS score of 7.5 indicates a high risk, but the EPSS score is below 1%, suggesting that current exploitation activity is low. The vulnerability is not listed in CISA’s KEV catalog. The attack requires the ability to send or provide crafted ASN.1 data to the vulnerable decoder. In practice, this can be achieved through network protocols that rely on pyasn1, local files, or any interface that passes ASN.1 structures to the library. Exploitation is straightforward once such input is accepted, as no authentication or privileged state is needed. The main mitigation is to update the library.