{"id":"CVE-2026-119195","kind":"vulnerability","aliases":["CVE-2026-119195"],"related":[],"title":"pyasn1: fragmented ASN.1 input makes decoding quadratic, exhausting CPU","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.","summary":"pyasn1, a Python ASN.1 library, repeatedly copies growing buffers when decoding constructed strings and indefinite-length ANY values. Attacker-supplied BER or CER data with many fragments can tie up decoding workers and exhaust CPU, with no confidentiality or integrity impact.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pyasn1","python"],"not_affected_if":["default-config","trusted-input-only"],"how_to_check":"- Check the installed version with `pip show pyasn1` or `python -c \"import pyasn1; print(pyasn1.__version__)\"`.\n- Look for services that decode untrusted BER or CER input with pyasn1 and set `asn1Spec` to `univ.Any` or `univ.OctetString`.","fix":"- pyasn1: `0.6.5`","status":"open","published_at":"2026-10-29T20:17:30+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","triaged_at":"2026-10-29T20:28:01+00:00","updated_at":"2026-10-29T20:28:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T20:28:01Z","model":"claude-haiku-5-5","output":{"fix":"- pyasn1: `0.6.5`","reach":"network","title":"pyasn1: fragmented ASN.1 input makes decoding quadratic, exhausting CPU","impact":"low","summary":"pyasn1, a Python ASN.1 library, repeatedly copies growing buffers when decoding constructed strings and indefinite-length ANY values. Attacker-supplied BER or CER data with many fragments can tie up decoding workers and exhaust CPU, with no confidentiality or integrity impact.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pyasn1"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Decoding workers are starved, causing denial of service through CPU exhaustion","analyst_note":"","how_to_check":"- Check the installed version with `pip show pyasn1` or `python -c \"import pyasn1; print(pyasn1.__version__)\"`.\n- Look for services that decode untrusted BER or CER input with pyasn1 and set `asn1Spec` to `univ.Any` or `univ.OctetString`.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","default-config"],"who_is_affected":"Applications that pass untrusted BER or CER data to pyasn1 decoders, particularly when asn1Spec selects univ.Any or univ.OctetString. Code that only decodes trusted data, or does not handle network-supplied ASN.1, is unlikely to be exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4388,"output_tokens":568,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119195':12A,15A '-2026':11A,14A '0.6.5':72C,211C 'accept':117C,129C 'also':128C 'anypayloaddecoder.indeflenvaluedecoder':174C 'asn.1':3A,22B,66C 'asn1spec':124C,161C 'attack':39B,91C 'attacker-control':90C 'attacker-suppli':38B 'ber':41B,93C,157C 'buffer':27B 'byte':88C 'caus':185C,197C 'cer':43B,95C,159C 'charact':105C,131C 'character-str':104C 'chunk':177C 'concaten':82C,172C,178C 'confidenti':58B,201C 'construct':30B,73C,100C,110C,130C 'control':92C 'copi':25B,180C 'cpu':9A,55B,198C 'cve':10A,13A 'data':44B,96C 'decod':6A,29B,51B,80C,194C 'definit':120C 'definite-length':119C 'der':108C,146C,164C 'encod':142C 'even':139C 'exhaust':8A,54B,199C 'fix':208C 'form':122C 'fragment':2A,47B,84C,107C,190C 'generic':65C 'grow':26B,87C,170C,176C 'header':171C 'impact':61B,204C 'increas':182C 'indefinit':34B,77C,150C,166C 'indefinite-length':33B,76C,149C 'input':4A 'integr':60B,203C 'issu':206C 'length':35B,78C,121C,151C,167C 'librari':23B,67C 'make':5A 'mani':46B,99C 'occupi':193C 'octet':101C,111C 'octetstringpayloaddecod':168C 'onto':85C 'packag':16B 'path':153C 'prefix':183C 'prior':70C 'pyasn1':1A,17B,19B,62C 'python':18B,21B,69C 'quadrat':7A,186C 'reachabl':155C 'reject':109C,165C 'repeat':24B,81C,179C 'schema':115C,138C 'select':125C,162C 'separ':148C 'string':31B,74C,102C,106C,112C,132C 'suffici':189C 'suppli':40B 'though':140C 'tie':49B 'univ.any':163C 'univ.octetstring':126C 'use':98C,169C,175C 'utf8string':135C 'valid':145C 'valu':37B,89C,191C 'version':210C 'without':113C,136C,200C 'work':187C 'worker':52B,195C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass untrusted BER or CER data to pyasn1 decoders, particularly when asn1Spec selects univ.Any or univ.OctetString. Code that only decodes trusted data, or does not handle network-supplied ASN.1, is unlikely to be exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T20:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119195","severity":null,"published_at":"2026-10-29T20:17:30+00:00","modified_at":"2026-10-29T20:17:30+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","fetched_at":"2026-10-29T20:26:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}