---
id: "CVE-2026-119196"
kind: "vulnerability"
aliases: ["CVE-2026-119196"]
title: "pyasn1: crafted BIT STRING input causes quadratic CPU exhaustion during decode"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "pyasn1", "python"]
not_affected_if: ["no-untrusted-asn1-decoding", "trusted-input-only"]
published_at: "2026-10-29T20:17:30+00:00"
first_seen_at: "2026-10-29T20:26:50+00:00"
updated_at: "2026-10-29T20:28:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119196", "first_seen_at": "2026-10-29T20:26:50+00:00"}]
---

# pyasn1: crafted BIT STRING input causes quadratic CPU exhaustion during decode

pyasn1, a Python ASN.1 library, decodes constructed BIT STRING fragments with work that grows quadratically with the number of fragments. An attacker who supplies crafted BER, CER or DER input can exhaust CPU during decode().

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show pyasn1` and look for a version below `0.6.5`.
- Search dependency lock files for `pyasn1` to find transitive uses that decode untrusted ASN.1 input.

## Fix

- pyasn1 `0.6.5`

## Timeline

- 2026-10-29T20:26:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119196

## From the sources

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_