Cloudanix VulnDB

CVE-2026-119194

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Oct 29, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A widely used Python library can be tricked into using far more processing power than needed when reading certain specially crafted data files, potentially slowing down or stopping services that rely on it.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Schemaless BER/CER/DER decoding in pyasn1 0.3.3-0.6.4 performs quadratic work inside ConstructedPayloadDecoderBase._decodeComponentsSchemaless because distinct long tag IDs from attacker input cause repeated TagSet hash collisions, forcing linear scans on each insertion while still producing valid decoded output.

Why it matters to the business

An unauthenticated remote attacker can send a small crafted ASN.1 payload that consumes large amounts of CPU, degrading or denying service to any application that uses the library to parse untrusted input; the flaw affects a widely used Python dependency with no public exploit code observed yet.

How an attack unfolds

An attacker generates a BER/CER/DER stream containing many distinct long tag numbers chosen to collide in the TagSet hash set; each successive tag forces the decoder to compare against an ever-growing list of prior collisions, driving CPU usage to quadratic in the number of tags until the process or service becomes unresponsive.

How to fix it

Upgrade pyasn1 to version 0.6.5 or later; if immediate upgrade is impossible, add input-size or processing-time limits around all ASN.1 decoding calls and consider schema-based decoding where feasible.

How to confirm the fix worked

Confirm the installed pyasn1 version is 0.6.5 or newer; run the library's test suite with large colliding-tag inputs and verify CPU time remains linear; monitor decoder process CPU and request latency under synthetic load matching the attack pattern.

Typical attack path

  1. Locate any network service or script that accepts untrusted ASN.1 data and passes it to pyasn1 for decoding
  2. Craft a BER/CER/DER payload containing many distinct long tags engineered for hash collisions
  3. Send the payload repeatedly or in a single large message to the decoder entry point
  4. Observe sustained high CPU utilization and eventual service degradation or outage

How to detect it

Search application and system logs for unusually long CPU time or timeouts in any process that imports pyasn1 and calls decode; look for inbound network flows carrying large BER/CER/DER structures immediately preceding high-CPU events.

What your security team should do

  • Immediately inventory all Python environments and containers for pyasn1 versions 0.3.3 through 0.6.4
  • Prioritize upgrade to 0.6.5 in internet-facing services and any path that parses untrusted ASN.1
  • Add runtime resource limits and request-size caps around ASN.1 decoding until patching is complete
  • Update dependency manifests and CI pipelines to block future vulnerable releases

The record

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities