Threats affecting pkg:brew/awscli%401

CVE-2026-119197 is a denial of service vulnerability in pyasn1 versions 0.6.4 and earlier, affecting the decoding of binary ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity due to inefficient byte processing, causing excessive CPU consumption. This impacts BER, CER, and DER decoders using the vulnerable RealPayloadDecoder. The vulnerability can be triggered when an application decodes attacker-controlled ASN.1 data containing REAL values. The issue was fixed in pyasn1 version 0.6.5 by optimizing the decoding loop.

CVE-2026-119196 is a vulnerability in the pyasn1 library (up to version 0.6.4) used by awscli@1 (versions >=1.20.20). It causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments, leading to potential CPU exhaustion and denial of service during ASN.1 decoding. This affects BER and CER decoders and certain schema-driven DER decoding paths. The vulnerability arises from inefficient bit-shifting operations on accumulated fragments. No confidentiality or integrity impacts are reported.

CVE-2026-119195 is a denial-of-service vulnerability in pyasn1 versions 0.6.4 and earlier, affecting awscli@1 versions >=1.20.20. The flaw causes quadratic-time CPU consumption when decoding constructed OCTET STRINGs or indefinite-length ANY types composed of many fragments, leading to CPU exhaustion. This occurs because the decoder repeatedly concatenates fragments inefficiently, causing excessive CPU use proportional to the square of the number of fragments. The vulnerability impacts BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported.

CVE-2026-119194 is a high-severity vulnerability in pyasn1 used by awscli@1 (versions >=1.20.20) where schemaless decoding of BER, CER, or DER data with many distinct long tag IDs causes quadratic CPU usage. This can lead to excessive CPU consumption and reduced service availability when processing attacker-controlled inputs. No confidentiality or integrity impacts are reported.