pyasn1 has quadratic-complexity denial of service in binary REAL decoding

Summary In pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time quadratic in the mantissa length. The BER, CER, and DER decoders all use the affected RealPayloadDecoder. An application is exposed when it passes attacker-controlled ASN.1 containing a REAL value to one of these decoders, either without an asn1Spec or with a schema that includes REAL. The work occurs inside decode(); the application does not need to convert, print, or otherwise use the resulting REAL object. This is distinct from [CVE-2026-59886](https://github.com/advisories/GHSA-hm4w-wwcw-mr6r), which concerns converting an already-decoded REAL to a Python float. That issue was fixed in 0.6.4 and its advisory states that decoding alone does not trigger it. Root cause and affected components For binary REAL values, [RealPayloadDecoder.valueDecoder in v0.6.4](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L535-L603) builds the mantissa one octet at a time: python p = 0 while chunk: p <<= 8 p |= chunk[0] chunk = chunk[1:] Each shift processes an integer that grows with the mantissa; with byte strings, each slice also copies the remaining…

curl https://cve.zerocrew.in/api/cve/CVE-2026-119197