Prior to version 0.6.4 the pyasn1 library decodes and encodes OBJECT IDENTIFIER and RELATIVE‑OID values in time quadratic to the number of arcs. A crafted payload that contains an OID with many arcs forces the decoder (or re‑encoder) to consume excessive CPU for each decode() call, which can exhaust system resources and render the application unavailable. This behavior corresponds to CWE‑1050 (Quadratic Time Complexity), CWE‑400 (Resource Exhaustion), and CWE‑407 (Recursive Resource Exhaustion), and allows an attacker to trigger a denial‑of‑service condition by sending a single malformed ASN.1 object.

The vulnerability affects all installations of pyasn1 older than 0.6.4. Any application that relies on pyasn1 to process ASN.1 encoded data—such as certificate validation libraries, network protocol implementations, or services that accept ASN.1 input from an external source—is at risk. The flaw is present in both the BER, CER, and DER decoders and the corresponding encoders.

The CVSS score of 7.5 classifies this flaw as a high‑severity denial‑of‑service vulnerability. The EPSS score indicates a very low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to supply a payload with a long OID to trigger the quadratic processing. This could be done remotely if an application accepts ASN.1 input from an external source, or locally if the data originates from a trusted or internal entity. The attack vector is inferred based on the description of a costly decode() call for untrusted input.