AIKIDO-2026-27979

TL;DR

The BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets in a loop with no upper bound on the tag ID size. A crafted substrate can force the decoder to build an arbitrarily large integer, with CPU and memory cost growing quadratically in input size. On Python 3.11+ the oversized tag ID can also raise an unhandled ValueError from the integer-to-string conversion limit while formatting error messages, breaking the PyAsn1Error contract. The fix limits long-form tag IDs to 20 octets, rejects longer ones with PyAsn1Error, and hardens tag repr rendering.