Cloudanix VulnDB

CVE-2026-119197

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Oct 29, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small specially crafted data file can make software that reads certain encoded messages use far too much processing power, potentially making the service unavailable until the file is rejected.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Binary REAL decoding in pyasn1 builds a large mantissa by repeated left-shift, OR, and suffix-copy operations per octet, yielding quadratic time complexity that allows a small attacker-controlled ASN.1 payload to monopolize a CPU core during decode().

Why it matters to the business

An unauthenticated remote attacker can trigger sustained high CPU usage on any service that parses untrusted ASN.1 data, leading to denial of service and degraded availability of dependent Python applications.

How an attack unfolds

An attacker crafts an ASN.1 message containing a binary-encoded REAL value with a large mantissa, submits it to any exposed BER/CER/DER decode path (with or without a schema), and forces the decoder to perform O(n^2) work, keeping a worker thread busy for seconds or longer per request.

How to fix it

Upgrade pyasn1 to version 0.6.5 or later; where immediate upgrade is impossible, apply input-size limits or schema restrictions that reject large-mantissa REAL values before decoding.

How to confirm the fix worked

Confirm the installed pyasn1 version is 0.6.5 or newer; replay a minimal large-mantissa REAL test vector and verify that decode latency remains linear rather than quadratic.

Typical attack path

  1. Identify an application endpoint or API that accepts ASN.1-encoded input and uses pyasn1 for decoding
  2. Generate a minimal ASN.1 REAL value whose mantissa length triggers repeated shift/OR/copy loops
  3. Transmit the payload over the network or supply it via file upload / message queue
  4. Observe single-core CPU saturation and request latency spikes on the target worker

How to detect it

Search application and system logs for high-CPU events during ASN.1 decode operations; correlate request timestamps with worker-thread CPU usage exceeding normal baselines; inspect any captured ASN.1 payloads for unusually long REAL mantissas.

What your security team should do

  • Prioritize upgrade to pyasn1 0.6.5 across all environments within the next 7 days
  • Add package-version monitoring and block deployments that still ship <0.6.5
  • Implement request-size or CPU-time limits on ASN.1 parsing paths as a temporary control
  • Review logs for sudden CPU spikes correlated with ASN.1 decode calls

The record

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities