Threats affecting pkg:brew/ansible%409

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability due to quadratic complexity in decoding binary-encoded ASN.1 REAL values with large mantissas. This causes excessive CPU consumption during decoding, potentially exhausting CPU resources. The issue affects BER, CER, and DER decoders that use the vulnerable RealPayloadDecoder. The vulnerability is fixed in pyasn1 version 0.6.5.

A vulnerability in pyasn1 versions up to 0.6.4 causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments. This can lead to CPU exhaustion and denial of service if attacker-controlled ASN.1 data is decoded. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. The vulnerability does not impact confidentiality or integrity but can cause service disruption.

pyasn1 versions 0.6.4 and earlier contain a denial of service vulnerability due to quadratic-time complexity in decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This occurs because the decoder repeatedly copies accumulated fragments, causing CPU exhaustion when processing attacker-controlled ASN.1 inputs with many fragments. The issue affects BER and CER decoding paths and certain non-DER constructed strings accepted by the DER decoder with specific schema. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5, indicating high severity.

CVE-2026-119194 is a high-severity vulnerability in pyasn1 used by Ansible@9 that causes quadratic CPU usage when decoding attacker-controlled BER, CER, or DER data without an ASN.1 schema. An attacker can craft inputs with many distinct long tag IDs that cause excessive CPU consumption, potentially leading to denial of service due to resource exhaustion. The flaw arises from inefficient handling of tag sets during schemaless decoding. No confidentiality or integrity impact is reported.

OAuthlib's token grant handlers allow an authenticated low-privilege client to supply a different client_id in the token request body, causing authorization checks to be performed under that other client identity. This affects the client_credentials and password grant flows where the application validator uses the client_id argument for authorization. The flaw enables a token authorization bypass where a low-privilege client can obtain tokens with scopes or grant types assigned to a higher-privilege client.