{"id":"CVE-2026-119197","kind":"vulnerability","aliases":["CVE-2026-119197"],"related":[],"title":"pyasn1: crafted REAL values make Python ASN.1 decoding hang a CPU core","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","summary":"pyasn1, a Python ASN.1 library, decodes binary REAL values with quadratic time in mantissa length. A crafted encoded value sent to a BER, CER or DER decoder can hold a worker on one CPU core for seconds or longer, causing denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asn1","package","pyasn1","python"],"not_affected_if":["no-untrusted-asn1-input","pyasn1-not-installed"],"how_to_check":"- `pip show pyasn1` to read the installed version\n- Search lock files and requirements for `pyasn1` to find pinned versions\n- Check whether the decoder receives untrusted ASN.1 input such as certificates, SNMP or LDAP data","fix":"- pyasn1 `0.6.5` or later","status":"open","published_at":"2026-10-29T20:17:30+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","triaged_at":"2026-10-29T20:28:01+00:00","updated_at":"2026-10-29T20:28:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T20:28:01Z","model":"claude-haiku-5-5","output":{"fix":"- pyasn1 `0.6.5` or later","reach":"network","title":"pyasn1: crafted REAL values make Python ASN.1 decoding hang a CPU core","impact":"low","summary":"pyasn1, a Python ASN.1 library, decodes binary REAL values with quadratic time in mantissa length. A crafted encoded value sent to a BER, CER or DER decoder can hold a worker on one CPU core for seconds or longer, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pyasn1","asn1"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Availability loss: a worker stalls on one CPU core for seconds","analyst_note":"","how_to_check":"- `pip show pyasn1` to read the installed version\n- Search lock files and requirements for `pyasn1` to find pinned versions\n- Check whether the decoder receives untrusted ASN.1 input such as certificates, SNMP or LDAP data","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-asn1-input","pyasn1-not-installed"],"who_is_affected":"Applications that run pyasn1 to decode ASN.1 data from untrusted sources, such as certificates, SNMP or LDAP messages, are exposed. Code that only decodes data it generates itself, or that does not use pyasn1, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4262,"output_tokens":536,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119197':15A,18A '-2026':14A,17A '0.6.5':76C,177C 'asn.1':7A,26B,70C,103C 'asn1':19B 'attack':101C 'attacker-control':100C 'avail':169C 'ber':45B,116C 'binari':29B,77C,107C 'binary-encod':106C 'build':80C 'byte':98C 'caus':62B,168C 'cer':46B,117C 'compar':150C 'contain':126C 'control':102C 'copi':137C 'core':12A,57B,162C 'cpu':11A,56B,161C 'craft':2A,39B 'cve':13A,16A 'decod':8A,28B,49B,79C,120C,143C,157C 'denial':63B 'der':48B,119C 'encod':40B,108C 'everi':139C 'fix':174C 'generic':69C 'grow':92C 'hang':9A 'hold':51B,155C 'includ':104C 'integ':93C 'issu':172C 'larg':82C,112C 'left':132C 'length':37B,148C 'librari':27B,71C 'longer':61B,166C 'loss':170C 'make':5A,142C 'mantissa':36B,83C,113C,140C,147C 'octet':85C,141C 'one':55B,84C,160C 'packag':20B 'perform':130C 'prior':74C 'pyasn1':1A,21B,23B,66C 'python':6A,22B,25B,73C 'quadrat':33B,145C 'reach':115C 'real':3A,30B,78C,109C,127C,152C 'realpayloaddecoder.valuedecoder':128C 'remain':97C 'repeat':129C 'schema':125C 'second':59B,164C 'sent':42B 'servic':65B 'shift':90C,133C 'slice':95C 'small':151C 'string':99C 'suffix':136C 'time':34B,88C,144C 'valu':4A,31B,41B,153C 'version':176C 'without':123C 'worker':53B,158C","nicknames":[],"mitigations":[],"who_affected":"Applications that run pyasn1 to decode ASN.1 data from untrusted sources, such as certificates, SNMP or LDAP messages, are exposed. Code that only decodes data it generates itself, or that does not use pyasn1, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T20:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119197","severity":null,"published_at":"2026-10-29T20:17:30+00:00","modified_at":"2026-10-29T20:17:30+00:00","first_seen_at":"2026-10-29T20:26:50+00:00","fetched_at":"2026-10-29T20:26:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}