Threats tagged 'brew-hermes-agent-cve-2026-119195'

In pyasn1 versions 0.6.4 and earlier used by hermes-agent, a quadratic-time denial of service vulnerability exists in the decoding of constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This flaw causes CPU usage to grow quadratically with the number of fragments during ASN.1 decoding, potentially allowing an attacker to exhaust CPU resources by supplying crafted ASN.1 input. The vulnerability affects BER and CER decoding paths and certain non-conforming DER inputs when an asn1Spec is used. No confidentiality or integrity impact is reported. A fix is available in version 2026.4.30.