PyPIPackage

pyasn1

9 known vulnerabilities (9 high), with the versions each affects and the releases that fix them.

Latest release: 0.6.5 (Oct 27, 2026): no advisory affects it
Newest unaffected release: 0.6.5 (Oct 27, 2026), the latest release
Advisories: 9 · 9 high

Weekly downloads: 118.2M
Dependents: 22.7K
Releases: 42 since 0.0.13 (Jul 10, 2011)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-119197
Affects 0.0.9a0 to 0.6.4 (0.6.5 is outside it)
CVE-2026-119196
Affects 0.0.9a0 to 0.6.4 (0.6.5 is outside it)
CVE-2026-119195
Affects 0.0.9a0 to 0.6.4 (0.6.5 is outside it)
CVE-2026-119194
Affects 0.3.3 to 0.6.4 (0.6.5 is outside it)
CVE-2026-59884
Affects 0.0.9a0 to 0.6.3 (0.6.4 is outside it)
CVE-2026-59885
Affects 0.0.9a0 to 0.6.3 (0.6.4 is outside it)
CVE-2026-59886
Affects 0.0.9a0 to 0.6.3 (0.6.4 is outside it)
CVE-2026-30922
Affects 0.0.9a0 to 0.6.2 (0.6.3 is outside it)
CVE-2026-23490
Affects 0.6.1 (0.6.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

CVE-2026-119197High 7.5
pyasn1: Quadratic-complexity denial of service in binary REAL decoding
Affected: fixed in 0.6.5.
Fixed in 0.6.5 (released Oct 27, 2026, 2 days before disclosure).
The latest release, 0.6.5, is not affected.
CVE-2026-119196High 7.5
pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding
Affected: fixed in 0.6.5.
Fixed in 0.6.5 (released Oct 27, 2026, 2 days before disclosure).
The latest release, 0.6.5, is not affected.
CVE-2026-119195High 7.5
pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding
Affected: fixed in 0.6.5.
Fixed in 0.6.5 (released Oct 27, 2026, 2 days before disclosure).
The latest release, 0.6.5, is not affected.
CVE-2026-119194High 7.5
pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding
Affected: from 0.3.3, fixed in 0.6.5.
Fixed in 0.6.5 (released Oct 27, 2026, 2 days before disclosure).
The latest release, 0.6.5, is not affected.
CVE-2026-59884High 7.5
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs
Affected: fixed in 0.6.4.
Fixed in 0.6.4 (released Jul 9, 2026, 5 days before disclosure).
The latest release, 0.6.5, is not affected.
CVE-2026-59885High 7.5
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
Affected: fixed in 0.6.4.
Fixed in 0.6.4 (released Jul 9, 2026, 5 days before disclosure).
The latest release, 0.6.5, is not affected.
CVE-2026-59886High 7.5
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
Affected: fixed in 0.6.4.
Fixed in 0.6.4 (released Jul 9, 2026, 5 days before disclosure).
The latest release, 0.6.5, is not affected.
CVE-2026-30922High 7.5
pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
Affected: fixed in 0.6.3.
Fixed in 0.6.3 (released Mar 17, 2026, 1 day before disclosure).
The latest release, 0.6.5, is not affected.
CVE-2026-23490High 7.5
pyasn1 has a DoS vulnerability in decoder
Affected: from 0.6.1, fixed in 0.6.2.
Fixed in 0.6.2 (released Jan 16, 2026, the day of disclosure).
The latest release, 0.6.5, is not affected.