A memory exhaustion vulnerability in the pyasn1 library allows unauthenticated remote attackers to cause a denial of service condition.

This vulnerability is classified as CWE-770, involving the allocation of resources without limits or throttling. Unauthenticated attackers can trigger this issue by providing malformed RELATIVE-OID inputs containing excessive continuation octets, which forces the library to exhaust system memory.

The ability for an unauthenticated attacker to remotely crash an application using the pyasn1 library poses a significant risk to service availability. With a CVSS score of 7.5, this high-severity flaw can lead to operational downtime for any system relying on this library for ASN.1 processing, potentially disrupting critical business functions and requiring manual intervention to restore services.

Immediate Action: Update the pyasn1 library to version 0.6.2 or later to include the necessary resource limits.

Proactive Monitoring: Monitor system memory usage patterns and application logs for unusual spikes or errors that correlate with inbound ASN.1 data processing.

Compensating Controls: While a WAF may struggle to inspect complex ASN.1 structures, implementing strict input validation or rate limiting at the application gateway can help reduce the volume of malicious requests reaching the library.

Public Exploit Available: Unknown.

Given the potential for remote denial of service and the existence of a proof-of-concept, administrators should prioritize updating the pyasn1 library across all affected production environments. Applying the 0.6.2 patch is the only effective way to remediate the underlying resource exhaustion flaw and ensure continued system stability.