pyasn1 0.6.5 fixes several quadratic-time denial-of-service bugs in BER/CER/DER decoding (CVE-2026-119194, -119195, -119196, -119197). Am I affected through a transitive dependency, and what should I update?

What it is: pyasn1 is the pure-Python ASN.1 library used under the hood by many packages that parse certificates, LDAP, SNMP, Kerberos and Google auth data (for example via pyasn1-modules, python-ldap tooling, rsa, oauth2client-era libraries, pysnmp). On October 30, 2026 the maintainers published four high advisories: decoding certain crafted inputs (constructed BIT STRING and string values with many fragments, indefinite-length ANY, binary REAL values, and schema-less containers) takes time that grows quadratically with input size, so a large attacker-supplied blob can pin a CPU during decode(). All are fixed in pyasn1 0.6.5. Am I affected: - pyasn1 0.6.4 or earlier installed: pip show pyasn1, or pipdeptree -r -p pyasn1 to see which packages pull it in. - Real risk if your service decodes ASN.1 data from untrusted sources (uploaded certificates or keys, LDAP or SNMP responses from untrusted peers, tokens) with pyasn1, directly or through a library. Purely internal use on trusted data is low risk. Fix: 1. Upgrade to pyasn1 0.6.5 or later (pip install -U pyasn1, or add a constraint pyasn1>=0.6.5 so your resolver picks it for transitive users), regenerate lock files, and redeploy. 2. If a dependency pins an older pyasn1, upgrade that dependency or override the pin, and test. 3. As general hardening, cap the size of inputs you pass to ASN.1 decoders and run decoding of untrusted data with timeouts. Verify: pip show pyasn1 reports 0.6.5+ in every environment (including Docker images and serverless bundles). Sources: https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5 https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5 https://github.com/advisories/GHSA-2qm8-x737-gmw5