---
id: "CVE-2026-119194"
kind: "vulnerability"
aliases: ["CVE-2026-119194"]
title: "pyasn1: crafted ASN.1 input makes Python decoding use excessive CPU"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "pyasn1", "python"]
not_affected_if: ["no-schemaless-decoding", "trusted-input-only"]
published_at: "2026-10-29T20:17:30+00:00"
first_seen_at: "2026-10-29T20:26:50+00:00"
updated_at: "2026-10-29T20:28:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119194", "first_seen_at": "2026-10-29T20:26:50+00:00"}]
---

# pyasn1: crafted ASN.1 input makes Python decoding use excessive CPU

pyasn1 is a Python library for decoding ASN.1 data such as BER, CER and DER. Attacker-supplied input with many distinct long tag IDs causes quadratic CPU work during schemaless decoding, so repeated inputs can exhaust CPU and slow or stop the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show pyasn1` and look at the version in your lock file.
- Search dependencies for `pyasn1` to find whether it is used on a path that decodes untrusted BER, CER or DER input.
- Look for schemaless decoding (decoder called without a schema) on data from outside your system.

## Fix

- pyasn1 `0.6.5`: the sources state this version fixes the issue; versions from 0.3.3 up to 0.6.5 are listed as affected.

## Timeline

- 2026-10-29T20:26:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119194

## From the sources

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_