{"id":"CVE-2026-119194","kind":"vulnerability","aliases":["CVE-2026-119194"],"related":[],"title":"pyasn1: crafted ASN.1 input makes Python decoding use excessive CPU","description":"pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.","summary":"pyasn1 is a Python library for decoding ASN.1 data such as BER, CER and DER. Attacker-supplied input with many distinct long tag IDs causes quadratic CPU work during schemaless decoding, so repeated inputs can exhaust CPU and slow or stop the service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pyasn1","python"],"not_affected_if":["no-schemaless-decoding","trusted-input-only"],"how_to_check":"- Check the installed version with `pip show pyasn1` and look at the version in your lock file.\n- Search dependencies for `pyasn1` to find whether it is used on a path that decodes untrusted BER, CER or DER input.\n- Look for schemaless decoding (decoder called without a schema) on data from outside your system.","fix":"- pyasn1 `0.6.5`: the sources state this version fixes the issue; versions from 0.3.3 up to 0.6.5 are listed as affected.","status":"open","published_at":"2026-10-29T20:17:30+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","triaged_at":"2026-10-29T20:28:01+00:00","updated_at":"2026-10-29T20:28:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T20:28:01Z","model":"claude-haiku-5-5","output":{"fix":"- pyasn1 `0.6.5`: the sources state this version fixes the issue; versions from 0.3.3 up to 0.6.5 are listed as affected.","reach":"network","title":"pyasn1: crafted ASN.1 input makes Python decoding use excessive CPU","impact":"low","summary":"pyasn1 is a Python library for decoding ASN.1 data such as BER, CER and DER. Attacker-supplied input with many distinct long tag IDs causes quadratic CPU work during schemaless decoding, so repeated inputs can exhaust CPU and slow or stop the service.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pyasn1"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Repeated crafted inputs exhaust decoder CPU and reduce service availability","analyst_note":"","how_to_check":"- Check the installed version with `pip show pyasn1` and look at the version in your lock file.\n- Search dependencies for `pyasn1` to find whether it is used on a path that decodes untrusted BER, CER or DER input.\n- Look for schemaless decoding (decoder called without a schema) on data from outside your system.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","no-schemaless-decoding"],"who_is_affected":"Applications that use pyasn1 to decode ASN.1 data from untrusted sources, particularly schemaless container decoding of BER, CER or DER input. Systems that only decode trusted data or do not use pyasn1 directly or through a dependency can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4250,"output_tokens":603,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119194':13A,16A '-2026':12A,15A '0.3.3':73C '0.6.5':75C,161C 'asn.1':3A,27B,68C 'attack':36B,102C 'attacker-control':101C 'attacker-suppli':35B 'avail':154C 'ber':31B,104C 'caus':45B 'cer':32B,105C 'collid':118C,130C 'compar':123C 'compon':82C 'constructedpayloaddecoderbase._decodecomponentsschemaless':133C 'contain':77C,109C 'control':103C 'cpu':10A,47B,57B,136C,150C 'craft':2A 'cve':11A,14A 'data':28B 'decod':7A,26B,51B,78C,81C,139C,149C 'der':34B,107C 'distinct':41B,111C 'distinguish':100C 'earlier':129C 'even':89C 'everi':80C 'excess':9A 'exhaust':56B,148C 'fix':158C 'generic':67C 'grow':87C 'hash':117C 'id':44B,114C 'increas':126C 'input':4A,38B,54B,108C,146C 'insert':122C 'issu':156C 'later':120C 'librari':24B,69C 'long':42B,112C 'make':5A 'mani':40B,110C 'multipl':95C 'must':98C 'number':127C 'one':93C 'one-versus-multipl':92C 'order':142C 'packag':17B 'produc':134C 'pyasn1':1A,18B,20B,64C 'python':6A,19B,23B,71C 'quadrat':46B,135C 'reduc':152C 'remain':143C 'repeat':53B,145C 'schemaless':50B,76C 'servic':63B,153C 'set':88C,121C 'slow':59B 'stop':61B 'store':79C 'suppli':37B 'tag':43B,96C,113C,131C 'tagset':84C,116C 'though':90C 'type':97C 'use':8A 'valid':144C 'valu':140C 'version':160C 'versus':94C 'whose':115C 'work':48B,137C","nicknames":[],"mitigations":[],"who_affected":"Applications that use pyasn1 to decode ASN.1 data from untrusted sources, particularly schemaless container decoding of BER, CER or DER input. Systems that only decode trusted data or do not use pyasn1 directly or through a dependency can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T20:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119194","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119194","severity":null,"published_at":"2026-10-29T20:17:30+00:00","modified_at":"2026-10-29T20:17:30+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","fetched_at":"2026-10-29T20:26:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}