Threats affecting pkg:brew/aws-shell

pyasn1 versions up to 0.6.4 contain a denial-of-service vulnerability in the decoding of binary ASN.1 REAL values with large mantissas. The decoding process uses a quadratic-time algorithm that can exhaust CPU resources when processing attacker-controlled input. This affects BER, CER, and DER decoders using the vulnerable RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5 by replacing the inefficient loop with a more efficient integer conversion.

pyasn1 versions through 0.6.4 contain a vulnerability in decoding constructed BIT STRING values where CPU consumption grows quadratically with input size. This occurs because the decoder repeatedly shifts and copies accumulated bits for each fragment, leading to potential CPU exhaustion and denial of service when processing attacker-controlled ASN.1 data. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5, indicating high severity.

A denial of service vulnerability exists in pyasn1 version 0.6.4 and earlier used by aws-shell, where decoding certain constructed ASN.1 string types or indefinite-length ANY types can cause quadratic CPU time consumption. This occurs due to inefficient string concatenation in the decoder, leading to CPU exhaustion when processing attacker-controlled inputs. The vulnerability affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. The CVSS v3.1 base score is 7.5 (high severity).

CVE-2026-119194 is a high-severity vulnerability in pyasn1 used by aws-shell that causes quadratic CPU usage when decoding attacker-controlled BER, CER, or DER data without an ASN.1 schema. The flaw arises from inefficient handling of tag sets during schemaless decoding, allowing crafted inputs with many distinct long tag IDs to exhaust CPU resources and degrade service availability. No confidentiality or integrity impacts are reported.