CVE-2026-119196: high-severity vulnerability in pyasn1
pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.4%
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
pyasn1 · pyasn1Related CVEs — pyasn1
In the same product, most dangerous first.
CVE-2026-30922HIGHpyasn1 Vulnerable to Denial of Service via Unbounded RecursionEPSS 0.8%CVE-2026-23490HIGHpyasn1 has a DoS vulnerability in decoderEPSS 0.8%CVE-2026-59884HIGHpyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsEPSS 0.6%CVE-2026-59885HIGHpyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceEPSS 0.6%CVE-2026-119195HIGHpyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decodingEPSS 0.5%CVE-2026-59886HIGHpyasn1: Uncontrolled resource consumption when converting decoded REAL valuesEPSS 0.4%