Threats affecting pkg:brew/gyb

pyasn1 versions up to 0.6.4 have a denial-of-service vulnerability in decoding binary-encoded ASN.1 REAL values with large mantissas. The decoding process uses a quadratic-time algorithm that can exhaust CPU resources when processing attacker-controlled input. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5 by replacing the inefficient loop with a more efficient integer conversion.

CVE-2026-119196 affects pyasn1 through version 0.6.4, where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption due to repeated shifting and copying operations. This can lead to CPU exhaustion and denial of service when processing sufficiently large, attacker-controlled ASN.1 data. The vulnerability impacts BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The issue arises from inefficient handling of constructed BIT STRING fragments during decoding.

pyasn1 versions 0.6.4 and earlier contain a denial-of-service vulnerability due to quadratic-time complexity in decoding constructed OCTET STRINGs, character strings, and indefinite-length ANY types. This occurs when decoding many fixed-size fragments, causing excessive CPU usage. The issue affects BER and CER decoding and certain non-conforming DER inputs. An attacker supplying crafted ASN.1 input to an affected decoder can cause CPU exhaustion. No confidentiality or integrity impact is reported.

CVE-2026-119194 is a high-severity vulnerability in pyasn1's schemaless BER, CER, and DER decoding that causes quadratic CPU usage when decoding attacker-controlled data with many distinct long tag IDs. This can lead to CPU exhaustion and reduced service availability. The issue arises because the decoder unnecessarily grows a set of tag identifiers, causing performance degradation with crafted inputs. No confidentiality or integrity impacts are reported.

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing authorization checks to be performed under that other client's identity. This affects the client_credentials and password grant flows when the application validator uses the client_id argument for authorization. The flaw allows a low-privilege client to obtain tokens with broader scopes or grant types assigned to another client. The issue is fixed in OAuthlib version 1.97.