Skip to content
fr Sign in
7.5 High

CVE-2026-119197 pyasn1 is a generic ASN.1 library for Python

Description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.

Affected products and versions

Product Affected versions Fixed in
pyasn1 0.6 earliest → < 0.6.5 0.6.5

References

Timeline

  1. Published
  2. Last modified

Other CVEs of pyasn1

The 9 CVEs of pyasn1 →
CVE-2026-119196 pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding 7.5 High CVE-2026-119195 pyasn1 is a generic ASN.1 library for Python 7.5 High CVE-2026-119194 pyasn1 is a generic ASN.1 library for Python 7.5 High CVE-2026-59884 pyasn1 is a generic ASN.1 library for Python 7.5 High
Track this CVE