AIKIDO-2026-296415

TL;DR

The der crate sorts the elements of a DER SET OF at decode time using a hand-rolled insertion sort in der_sort. That sort runs in O(n^2) time, so a crafted reverse-sorted SET OF forces roughly n(n-1)/2 comparisons and swaps on every SetOfVec or heapless SetOf decode. An attacker who supplies untrusted DER, such as a certificate parsed through x509-cert or a CMS structure, can make a single decode consume large amounts of CPU time and cause denial of service. The fix replaces the insertion sort with an in-place O(n log n) sort_unstable_by while preserving DER ordering and duplicate handling.