Log in Start free

Vulnerability · Published Oct 29, 2026 · Assigned by GitHub_M

CVE-2026-119194pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding

High 7.5

In plain English

A high-severity security flaw in pyasn1 from pyasn1. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 63.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12pyasn1no fix listedDEBIAN-CVE-2026-119194
Debian:13pyasn1no fix listedDEBIAN-CVE-2026-119194
Debian:14pyasn10.6.5-1DEBIAN-CVE-2026-119194
PyPIpyasn10.6.5GHSA-fm9c-5rcf-2q5p
Ubuntu:22.04:LTSpyasn1no fix listedUBUNTU-CVE-2026-119194
Ubuntu:24.04:LTSpyasn1no fix listedUBUNTU-CVE-2026-119194
Ubuntu:26.04:LTSpyasn1no fix listedUBUNTU-CVE-2026-119194
Ubuntu:26.10pyasn1no fix listedUBUNTU-CVE-2026-119194

Affected products (as reported)

VendorProductVersions
pyasn1 pyasn1 >= 0.3.3, < 0.6.5

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References