CVE-2026-119195

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Oct 29, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A Python library used to read structured data can be tricked by specially crafted input into using far more processing power than needed, allowing anyone on the network to slow down or stop affected services.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: Low
Impact: Denial Of Service
Component: Library
Class: Denial of service
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Quadratic CPU consumption during BER/CER decoding of constructed OCTET STRING, character-string, and indefinite-length ANY values caused by repeated concatenation of fragments into a growing bytes buffer.

Why it matters to the business

Remote unauthenticated attackers can trigger sustained high CPU usage on any service that parses untrusted ASN.1 data, leading to worker exhaustion, request latency spikes, or complete denial of service with no data loss or theft.

How an attack unfolds

An attacker crafts a BER or CER PDU containing hundreds or thousands of small constructed fragments for an OCTET STRING, UTF8String, or indefinite-length ANY; when the library decodes it without a restricting schema, the repeated prefix-copy operations consume quadratic time and CPU until the worker is starved.

How to fix it

Upgrade pyasn1 to version 0.6.5 or later in all environments. Where immediate upgrade is not possible, enforce strict DER-only parsing or place untrusted ASN.1 inputs behind strict size and fragment-count limits.

How to confirm the fix worked

Confirm installed version is 0.6.5 or newer; run the library's test suite with the provided constructed-string and indefinite-length test vectors; monitor CPU profiles during parsing of large fragmented inputs.

Typical attack path

Identify a network service or API that accepts BER/CER-encoded ASN.1 (e.g., SNMP, LDAP, or custom protocols using pyasn1).
Generate a malicious payload consisting of many small constructed string fragments or an indefinite-length ANY.
Send the payload over the network or via an application input path that reaches the vulnerable decoder.
Observe sustained CPU utilization and eventual worker or process exhaustion on the target.

How to detect it

Monitor for processes or containers showing sudden, sustained high CPU while handling ASN.1 or BER/CER traffic; inspect application logs for unusually large or fragmented ASN.1 structures; correlate with inbound network flows containing BER/CER content.

What your security team should do

Upgrade pyasn1 to 0.6.5 within the next 48 hours given the two-day publication window.
Add dependency scanning to block future vulnerable pyasn1 releases.
Review all code paths that decode untrusted BER/CER data and apply schema or length constraints where feasible.
Enable resource limits or circuit breakers around ASN.1 decoding workers.

The record

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.

Affected packages

Ecosystem	Package	Introduced	Fixed