{"id":"CVE-2026-119196","kind":"vulnerability","aliases":["CVE-2026-119196"],"related":[],"title":"pyasn1: crafted BIT STRING input causes quadratic CPU exhaustion during decode","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.","summary":"pyasn1, a Python ASN.1 library, decodes constructed BIT STRING fragments with work that grows quadratically with the number of fragments. An attacker who supplies crafted BER, CER or DER input can exhaust CPU during decode().","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pyasn1","python"],"not_affected_if":["no-untrusted-asn1-decoding","trusted-input-only"],"how_to_check":"- Check the installed version with `pip show pyasn1` and look for a version below `0.6.5`.\n- Search dependency lock files for `pyasn1` to find transitive uses that decode untrusted ASN.1 input.","fix":"- pyasn1 `0.6.5`","status":"open","published_at":"2026-10-29T20:17:30+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","triaged_at":"2026-10-29T20:28:01+00:00","updated_at":"2026-10-29T20:28:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T20:28:01Z","model":"claude-haiku-5-5","output":{"fix":"- pyasn1 `0.6.5`","reach":"network","title":"pyasn1: crafted BIT STRING input causes quadratic CPU exhaustion during decode","impact":"medium","summary":"pyasn1, a Python ASN.1 library, decodes constructed BIT STRING fragments with work that grows quadratically with the number of fragments. An attacker who supplies crafted BER, CER or DER input can exhaust CPU during decode().","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pyasn1"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Decoding untrusted input exhausts CPU and stalls the service.","analyst_note":"","how_to_check":"- Check the installed version with `pip show pyasn1` and look for a version below `0.6.5`.\n- Search dependency lock files for `pyasn1` to find transitive uses that decode untrusted ASN.1 input.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","no-untrusted-asn1-decoding"],"who_is_affected":"Applications that decode attacker-controlled BER, CER or schema-driven DER input with pyasn1 before 0.6.5, such as certificate, LDAP, SNMP or Kerberos parsers built on it. Code that only handles trusted ASN.1 data, or that does not decode untrusted input, is not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4254,"output_tokens":538,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119196':14A,17A '-2026':13A,16A '0.6.5':66C,152C 'accept':101C 'accumul':79C 'also':100C 'asn.1':24B,60C 'attack':42B,84C 'attacker-control':83C 'ber':46B,86C 'bit':3A,28B,68C,77C,93C,107C 'bitstr':116C 'bitstring.fromoctetstring':112C 'bitstringpayloaddecod':109C 'call':111C 'caus':6A,129C 'cer':47B,88C 'complet':76C 'construct':27B,67C,92C,106C 'contain':90C 'control':85C 'convers':143C 'copi':74C 'cpu':8A,53B,137C 'craft':2A,45B 'cve':12A,15A 'decod':11A,26B,55B,70C,139C 'definit':104C 'definite-length':103C 'der':49B,99C 'driven':98C 'earlier':81C 'ever':122C 'ever-grow':121C 'exhaust':9A,52B,136C 'fix':149C 'format':145C 'fragment':30B,40B,82C,95C,127C,133C 'generic':59C 'grow':34B,123C 'input':5A,50B,89C 'issu':147C 'larg':132C 'later':142C 'length':105C 'librari':25B,61C 'mani':91C 'number':38B 'packag':18B 'prepend':118C 'prior':64C,115C 'pyasn1':1A,19B,21B,56C 'python':20B,23B,63C 'quadrat':7A,35B,130C 'repeat':71C,110C 'requir':141C 'schema':97C 'schema-driven':96C 'shift':72C,119C 'sizedinteg':124C 'string':4A,29B,69C,94C,108C 'suppli':44B 'valu':78C,134C 'version':151C 'without':140C 'work':32B,131C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode attacker-controlled BER, CER or schema-driven DER input with pyasn1 before 0.6.5, such as certificate, LDAP, SNMP or Kerberos parsers built on it. Code that only handles trusted ASN.1 data, or that does not decode untrusted input, is not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T20:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119196","severity":null,"published_at":"2026-10-29T20:17:30+00:00","modified_at":"2026-10-29T20:17:30+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","fetched_at":"2026-10-29T20:26:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}