Live › vulnerability › CVE-2026-119194
pyasn1 is a Python library for decoding ASN.1 data such as BER, CER and DER. Attacker-supplied input with many distinct long tag IDs causes quadratic CPU work during schemaless decoding, so repeated inputs can exhaust CPU and slow or stop the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 20:26 UTC. All times on this page are UTC.
Applications that use pyasn1 to decode ASN.1 data from untrusted sources, particularly schemaless container decoding of BER, CER or DER input. Systems that only decode trusted data or do not use pyasn1 directly or through a dependency can skip it.
No product ranges from the sources yet.
pip show pyasn1 and look at the version in your lock file.pyasn1 to find whether it is used on a path that decodes untrusted BER, CER or DER input.0.6.5: the sources state this version fixes the issue; versions from 0.3.3 up to 0.6.5 are listed as affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-119194")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.