pyasn1 versions up to 0.6.4 have a denial-of-service vulnerability in decoding binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in the mantissa length, causing excessive CPU consumption. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. An attacker supplying crafted ASN.1 REAL values to an application using these decoders can cause CPU exhaustion during decoding. The issue is fixed in pyasn1 version 0.6.5.
CVE-2026-119196 is a vulnerability in pyasn1 versions through 0.6.4 where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption. This can lead to CPU exhaustion and denial of service when processing attacker-controlled ASN.1 data. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5, indicating high severity.
pyasn1 versions 0.6.4 and earlier contain a quadratic-time denial of service vulnerability in decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This flaw causes excessive CPU consumption when processing many fixed-size fragments, potentially leading to CPU exhaustion if attacker-controlled ASN.1 input is decoded without proper limits. The issue affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impacts are reported. The vulnerability has a CVSS score of 7.5, indicating high severity.
CVE-2026-119194 is a high-severity vulnerability in pyasn1 used by Ansible@13 (version 13.7.0 and later). It causes quadratic CPU usage when decoding attacker-controlled schemaless BER, CER, or DER data with many distinct long tag IDs, potentially leading to denial of service by exhausting CPU resources. The flaw arises from inefficient handling of TagSet insertions during decoding. No confidentiality or integrity impacts were observed.
OAuthLib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body. This causes grant and scope validation to be performed under the attacker-supplied client_id rather than the authenticated client's identity. The flaw affects the client_credentials and password grant flows. The impact is that a lower-privilege client can obtain tokens with scopes or grant types assigned to a higher-privilege client. A fix is available in version 13.8.0_3.
The joserfc library version 1.7.4 has a vulnerability in its compact JWS size guard. It allocates attacker-controlled memory segments before validating their size, leading to excessive memory allocation prior to rejecting oversized inputs. This can cause increased memory usage and potentially trigger MemoryError exceptions under constrained environments.
The joserfc library's JWE General JSON parser accepts an attacker-controlled recipients array of unlimited length and performs a costly RSA private-key decryption operation for each recipient. This lack of a cap on recipient count enables an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE JSON document with many recipients. The library's documented mitigation option does not reduce CPU usage, making the issue exploitable. A fix is available in version 5.0.0.
The Kaskade OAuth 2.0 Dynamic Client Registration Management implementation in Authlib has a security flaw where example code omits the critical check binding the registration_access_token to the specific client. This omission allows an attacker possessing any valid registration_access_token and knowledge of a client_id to bypass authorization and access, modify, or delete that client's registration. The vulnerability affects versions 4.0.4 and later. The CVSS 3.1 score is 8.8 (high severity).