pyasn1 versions 0.6.4 and earlier contain a denial of service vulnerability due to quadratic-time processing when decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This occurs because the decoder repeatedly concatenates fragments in a way that causes CPU time to grow quadratically with the number of fragments. An attacker supplying crafted ASN.1 input to an affected decoder can cause CPU exhaustion. The issue affects BER and CER decoding paths and certain non-DER constructed strings accepted by the DER decoder with specific schema. No confidentiality or integrity impact is reported.