Inefficient Algorithmic Complexity in py-asn1 - CVE-2026-119194
Published: November 9, 2026
Vulnerability identifier: #VU163166
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119194
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and reduce service availability in applications that decode attacker-controlled ASN.1 data without a schema.
The vulnerability exists due to hash collisions causing quadratic CPU use when pyasn1's schemaless BER, CER, or DER decoder processes containers with many distinct long tag identifiers. An unauthenticated remote attacker can repeatedly submit these valid containers to consume disproportionate CPU time during decoding.
Affected software
py-asn1
How to mitigate CVE-2026-119194
Install security update from vendor's website.
py-asn1 - update to 0.6.5