Log in Start free

Vulnerability · Published Oct 29, 2026 · Assigned by GitHub_M

CVE-2026-119196pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding

High 7.5

In plain English

A high-severity security flaw in pyasn1 from pyasn1. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 63.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12pyasn1no fix listedDEBIAN-CVE-2026-119196
Debian:13pyasn1no fix listedDEBIAN-CVE-2026-119196
Debian:14pyasn10.6.5-1DEBIAN-CVE-2026-119196
PyPIpyasn10.6.5GHSA-2qm8-x737-gmw5
Ubuntu:22.04:LTSpyasn1no fix listedUBUNTU-CVE-2026-119196
Ubuntu:24.04:LTSpyasn1no fix listedUBUNTU-CVE-2026-119196
Ubuntu:26.04:LTSpyasn1no fix listedUBUNTU-CVE-2026-119196
Ubuntu:26.10pyasn1no fix listedUBUNTU-CVE-2026-119196

Affected products (as reported)

VendorProductVersions
pyasn1 pyasn1 < 0.6.5

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References