Inefficient Algorithmic Complexity in py-asn1 - CVE-2026-119196
Published: November 9, 2026
Vulnerability identifier: #VU163168
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119196
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and cause denial of service in applications decoding untrusted ASN.1 with pyasn1.
The vulnerability exists due to repeated copying of accumulated data during constructed BIT STRING decoding in BER and CER, or schema-driven DER accepting definite-length values. An unauthenticated remote attacker can submit values containing many fragments to an exposed application whose input limits permit sufficiently large payloads, causing quadratic decoding work that occupies decoding workers.
Affected software
py-asn1
How to mitigate CVE-2026-119196
Install security update from vendor's website.
py-asn1 - update to 0.6.5