ETK-2026-2772Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2772",
  "cve_id": null,
  "display_id": "ETK-2026-2772",
  "ghsa_id": "GHSA-mm57-4v3p-rchx",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Quadratic CPU denial of service in pyasn1 REAL decoding",
  "summary": "pyasn1 through 0.6.4 can spend disproportionate CPU time decoding large binary ASN.1 REAL values through its BER, CER, or DER decoders. An attacker who can provide ASN.1 input to an affected decode path can exhaust decoder CPU resources when REAL values are accepted, including schemas that contain REAL.",
  "mitigation": "Upgrade pyasn1 to version 0.6.5. Until upgraded, reject or strictly cap the size of untrusted ASN.1 inputs that may contain REAL values before decoding them.",
  "vendor": "pip",
  "product": "pip:pyasn1",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.6.4"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "0.6.5"
      ],
      "package_name": "pyasn1",
      "purl": "pkg:pypi/pyasn1"
    }
  ],
  "cwes": [
    407
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 30.658629016666666,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-27T06:59:39+00:00",
      "days": -0.5026401442013889,
      "is_lower_bound": true,
      "measured_at": "2026-10-27T19:03:27.150291+00:00",
      "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx"
    },
    "trigger_signal": {
      "at": "2026-10-27T06:59:39+00:00",
      "days": -0.5026401442013889,
      "is_lower_bound": true,
      "measured_at": "2026-10-27T19:03:27.150291+00:00",
      "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx"
    }
  }
}