Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1expendoctetstring.

A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.

An issue was discovered in the asn1decodesimpleber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Last updated 25 August 2025

It was discovered that libtasn1 library function asn1getbitder() could incorrectly report negative bit length of the value read from ASN.1 input. This could possibly lead to an out of bounds access in an application using libtasn1, for example in case if application tried to terminate read value with NUL byte.

The following upstream commit corrects the issue and causes the function to report error rather than return negative length value: http://git.savannah.gnu.org/cgit/libtasn1.git/commit/?id=1c3ccb3e040bf13e342ee60bc23b21b97b11923f

libtasn1 version 2.12 was released fixing the following issue:

- Corrected DER decoding issue (reported by Matthew Hall). Added self check to detect the problem, see tests/Testoverflow.c. This problem can lead to at least remotely triggered crashes, see further analysis on the libtasn1 mailing list.

http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/53

Upstream and few limited details are available at:

http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/54

The behavior of asn1getlengthder was changed to protect against accidental incorrect use, if though it was previously "working properly and as documented".