Skip to content

Upgrading pyasn1 0.5 to 0.6

Breaking0.5.1 → 0.6.5Security9Platform3New1Fixed3Other6

Full comparisonBack to pyasn1
BreakingUpgrade verdict

3 platform requirement changes and 9 security fixes.

In plain terms
  • The package can now be used with Python 3.14.
  • The package now works with the newest Python version, 3.13.
  • This version no longer runs on very old Python versions (2.7, 3.6, 3.7).
  • A maliciously crafted REAL value could make decoding very slow. Decoding is now linear time.
Must act Top 5 of 12 that need code or config changes

Python requirement changed in 0.6.0: !=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,>=2.7 → >=3.8.

What you must change

Security9
Fixes GHSA-mm57-4v3p-rchx by decoding binary REAL mantissas in linear time instead of repeatedly shifting a growing integer.
High · CVSS 7.5
0.6.5GitHub ReleaseSummarizedView source
Fixes GHSA-2qm8-x737-gmw5 by reassembling constructed BIT STRING fragments in linear time while preserving decoded bit values.
High · CVSS 7.5
0.6.5GitHub ReleaseSummarizedView source
Fixes GHSA-9m75-vc3g-4x39 by reassembling constructed OCTET STRING, character-string and indefinite-length ANY content in linear time.
High · CVSS 7.5
0.6.5GitHub ReleaseSummarizedView source
Fixes GHSA-fm9c-5rcf-2q5p by bounding schemaless container type tracking after two distinct tag sets to prevent quadratic CPU use.
High · CVSS 7.5
0.6.5GitHub ReleaseSummarizedView source
Fixes quadratic time complexity in OBJECT IDENTIFIER and RELATIVE-OID decoders that let crafted encodings with many arcs consume excessive CPU.
OBJECT IDENTIFIERRELATIVE-OIDHigh · CVSS 7.5
0.6.4GitHub ReleaseSummarizedView source
Limits BER long-form tag IDs to 20 octets (140 bits) to prevent excessive CPU and memory use from crafted substrates.
BERHigh · CVSS 7.5
0.6.4GitHub ReleaseSummarizedView source
Fixes excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.
Real.__float__()High · CVSS 7.5
0.6.4GitHub ReleaseSummarizedView source
Adds a nesting depth limit to the ASN.1 decoder to prevent stack overflow from deeply nested structures (CVE-2026-30922).
High · CVSS 7.5
0.6.3GitHub ReleaseSummarizedView source
Fixes continuation octet limits in the OID/RELATIVE-OID decoder (CVE-2026-23490).
OIDRELATIVE-OIDHigh · CVSS 7.5
0.6.2GitHub ReleaseSummarizedView source
Platform3
Adds support for Python 3.14.
0.6.2GitHub ReleaseSummarizedView source
Adds support for Python 3.13.
0.6.1GitHub ReleaseSummarizedView source
Removes support for end-of-life Python 2.7, 3.6 and 3.7.
0.6.0GitHub ReleaseSummarizedView source