pyasn1 versions from 0.3.3 up to but not including 0.6.5 have a vulnerability causing quadratic CPU usage when decoding attacker-controlled BER, CER, or DER data without an ASN.1 schema. This occurs due to inefficient handling of tag sets during schemaless decoding, allowing crafted inputs with many distinct long tag IDs to exhaust CPU resources and degrade service availability. No confidentiality or integrity impacts are reported. The issue is fixed in version 0.6.5.