Attackers Can Exhaust Pyasn1 CPU Through Quadratic Decoding Flaws

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in pyasn1, a Python library for encoding and decoding ASN.1 data. The issues affect releases of pyasn1, with several affecting versions through 0.6.4, and involve quadratic-complexity CPU consumption in multiple decoding paths. An attacker who can supply crafted ASN.1 input to an application using the library can cause denial of service by exhausting CPU resources.

CVE-2026-119194 (CVSS 7.5 — High): This issue affects schemaless container decoding for BER, CER, and DER. A remote attacker can supply a crafted container with many distinct long tag identifiers, causing repeated comparisons and CPU exhaustion.[emaillocker id="1283"]

CVE-2026-119195 (CVSS 7.5 — High): This issue affects constructed string and indefinite-length ANY decoding. A remote attacker can supply a value composed of many fragments, causing repeated copying of the accumulated value and CPU exhaustion.

CVE-2026-59885: This issue affects OBJECT IDENTIFIER or RELATIVE-OID accumulation during decoding. An attacker who can supply crafted identifier data can cause quadratic-time CPU consumption and denial of service.

CVE-2026-119197 (CVSS 7.5 — High): This issue affects binary REAL decoding in BER, CER, and DER. A remote attacker can supply a REAL value with a large mantissa, causing quadratic CPU consumption during decoding.

CVE-2026-59886: This issue affects conversion of an already decoded REAL value to a floating-point number. An attacker who can cause an application to perform that conversion on attacker-influenced data can trigger disproportionate CPU use.

CVE-2026-119196 (CVSS 7.5 — High): This issue affects constructed BIT STRING decoding in BER, CER, and certain schema-driven DER paths. A remote attacker can supply a constructed BIT STRING with many fragments, causing repeated shifting and copying of the accumulated value.

These vulnerabilities collectively present a significant availability risk for applications that decode untrusted ASN.1 data. The most exposed systems are those that accept network input and pass it directly to the library. Affected deployments should treat such input as a potential denial-of-service vector.

RECOMMENDATION:

We recommend you to update pyasn1 to version 0.6.5.

REFERENCES:

The following reports contain further technical details:

• https://github.com/advisories/GHSA-2qm8-x737-gmw5
• https://github.com/advisories/GHSA-fm9c-5rcf-2q5p
• https://github.com/advisories/GHSA-9m75-vc3g-4x39
• https://github.com/advisories/GHSA-mm57-4v3p-rchx