pyasn1 versions up to 0.6.4 have a denial-of-service vulnerability in decoding binary-encoded ASN.1 REAL values with large mantissas. The decoding process uses a quadratic-time algorithm that can exhaust CPU resources when processing attacker-controlled input. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5 by replacing the inefficient loop with a more efficient integer conversion.