Live › vulnerability › CVE-2026-119196
pyasn1, a Python ASN.1 library, decodes constructed BIT STRING fragments with work that grows quadratically with the number of fragments. An attacker who supplies crafted BER, CER or DER input can exhaust CPU during decode().
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 20:26 UTC. All times on this page are UTC.
Applications that decode attacker-controlled BER, CER or schema-driven DER input with pyasn1 before 0.6.5, such as certificate, LDAP, SNMP or Kerberos parsers built on it. Code that only handles trusted ASN.1 data, or that does not decode untrusted input, is not exposed.
No product ranges from the sources yet.
pip show pyasn1 and look for a version below 0.6.5.pyasn1 to find transitive uses that decode untrusted ASN.1 input.0.6.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-119196")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.