Inefficient Algorithmic Complexity in py-asn1 - CVE-2026-119195
Published: November 9, 2026
Vulnerability identifier: #VU163167
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119195
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources in applications that decode untrusted ASN.1 input with pyasn1 without adequate input or resource limits.
The vulnerability exists due to repeated copying of accumulated data when pyasn1 decoders process constructed strings or indefinite-length ANY values containing many fragments, causing quadratic processing time. An unauthenticated remote attacker can submit repeated crafted inputs to occupy available decoding workers and deny service without user interaction.
Affected software
py-asn1
How to mitigate CVE-2026-119195
Install security update from vendor's website.
py-asn1 - update to 0.6.5