SB20261109218 - Multiple vulnerabilities in py-asn1
Published: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-119194)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and reduce service availability in applications that decode attacker-controlled ASN.1 data without a schema.
The vulnerability exists due to hash collisions causing quadratic CPU use when pyasn1's schemaless BER, CER, or DER decoder processes containers with many distinct long tag identifiers. An unauthenticated remote attacker can repeatedly submit these valid containers to consume disproportionate CPU time during decoding.
2) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-119195)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources in applications that decode untrusted ASN.1 input with pyasn1 without adequate input or resource limits.
The vulnerability exists due to repeated copying of accumulated data when pyasn1 decoders process constructed strings or indefinite-length ANY values containing many fragments, causing quadratic processing time. An unauthenticated remote attacker can submit repeated crafted inputs to occupy available decoding workers and deny service without user interaction.
3) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-119196)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and cause denial of service in applications decoding untrusted ASN.1 with pyasn1.
The vulnerability exists due to repeated copying of accumulated data during constructed BIT STRING decoding in BER and CER, or schema-driven DER accepting definite-length values. An unauthenticated remote attacker can submit values containing many fragments to an exposed application whose input limits permit sufficiently large payloads, causing quadratic decoding work that occupies decoding workers.
4) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-119197)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and deny service in applications decoding attacker-controlled ASN.1 data with pyasn1.
The vulnerability exists due to quadratic processing of large binary REAL mantissas in the BER, CER, and DER decoders. An unauthenticated remote attacker can supply such a value to an application decoding without an ASN.1 schema or with a schema permitting REAL, occupying a decoder worker for seconds or longer.
Remediation
Install update from vendor's website.