{"id":"CVE-2026-119195","revision":"b46fed794f714c0ea3d3a364ea5b2e1c","records":[{"revision":"b46fed794f714c0ea3d3a364ea5b2e1c","observedAt":"2026-10-29T21:14:49.558+00:00","statement":{"source":"cve-program","id":"CVE-2026-119195","aliases":[],"title":"pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.","state":0,"publishedAt":"2026-10-29T19:41:37.352+00:00","modifiedAt":"2026-10-29T19:41:37.352+00:00","affected":[{"ecosystem":"Vendor product","name":"pyasn1","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"pyasn1\",\n                    \"product\": \"pyasn1\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.6.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119195","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-119195","identifiers":["CVE-2026-119195"]},"retained":false,"historicalAffected":[]}],"coverage":[]}