Cloudanix VulnDB

CVE-2026-119196

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Oct 29, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a Python library used for reading structured data lets attackers send specially formatted input that makes the software use far more processing power than expected, potentially shutting down services that depend on it.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Prior to 0.6.5, pyasn1's BitStringPayloadDecoder performs repeated prepend operations and SizedInteger shifts when decoding constructed BIT STRING fragments from BER/CER input, resulting in quadratic CPU consumption that can exhaust resources during decode() on large fragmented values.

Why it matters to the business

Applications that parse untrusted ASN.1 data can experience sudden denial of service from CPU exhaustion, disrupting services that rely on the library and requiring emergency restarts or resource scaling.

How an attack unfolds

An attacker supplies a specially crafted BER or CER encoded message containing many constructed BIT STRING fragments; the decoder repeatedly calls fromOctetString with accumulating prior state, causing quadratic work that exhausts CPU without needing schema conversion or further processing.

How to fix it

Upgrade pyasn1 to version 0.6.5 or later in all affected Python environments; where immediate upgrade is not possible, implement strict input size limits or schema validation before decoding untrusted data.

How to confirm the fix worked

Confirm the installed pyasn1 version is 0.6.5 or higher; test decoding of large constructed BIT STRING inputs to verify linear rather than quadratic resource usage.

Typical attack path

  1. Identify a network endpoint or API that accepts BER/CER-encoded ASN.1 data processed by pyasn1
  2. Craft a payload with numerous constructed BIT STRING fragments of increasing size
  3. Send the payload to trigger repeated decoder calls
  4. Observe CPU exhaustion leading to service unavailability

How to detect it

Review application logs for unusually long decode() execution times or high CPU usage during ASN.1 parsing; correlate with incoming network traffic containing BER/CER data.

What your security team should do

  • Prioritize upgrade to pyasn1 0.6.5 across all deployments within the next maintenance window
  • Add dependency scanning to CI/CD pipelines to block future vulnerable versions
  • Monitor for high-CPU events correlated with ASN.1 parsing endpoints

The record

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities