pyasn1 0.6.3
PkgFire would install this release with a warning.·Checked 5 hours ago·Published 17 March 2026
Why
-
warnVulnerability
PYSEC-2026-3455 (fixed in 0.6.4)
-
warnVulnerability
PYSEC-2026-3456 (fixed in 0.6.4)
-
warnVulnerability
PYSEC-2026-3457 (fixed in 0.6.4)
-
warnVulnerability
pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding (fixed in 0.6.5)
-
warnVulnerability
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (fixed in 0.6.4)
-
warnVulnerability
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding (fixed in 0.6.5)
-
warnVulnerability
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding (fixed in 0.6.5)
-
warnVulnerability
pyasn1: Uncontrolled resource consumption when converting decoded REAL values (fixed in 0.6.4)
-
warnVulnerability
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs (fixed in 0.6.4)
-
warnVulnerability
pyasn1 has quadratic-complexity denial of service in binary REAL decoding (fixed in 0.6.5)
Provenance
A registry signature proves the registry served these bytes unaltered. Build provenance proves which workflow built them from which commit; a stolen publishing token can fake the first but not the second.
- Signature
- Not signed
- Build provenance
- None, and no earlier version had any
What the code does
On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.
Source patterns
Patterns found in the source, including those malware is known to use.
Other checked releases
Check every dependency before it installs
This page is one release. PkgFire checks every package in your lockfile, on every install and in every pull request, and blocks the bad ones before they run.