Inefficient Algorithmic Complexity in py-asn1 - CVE-2026-119197
Published: November 9, 2026
Vulnerability identifier: #VU163169
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119197
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and deny service in applications decoding attacker-controlled ASN.1 data with pyasn1.
The vulnerability exists due to quadratic processing of large binary REAL mantissas in the BER, CER, and DER decoders. An unauthenticated remote attacker can supply such a value to an application decoding without an ASN.1 schema or with a schema permitting REAL, occupying a decoder worker for seconds or longer.
Affected software
py-asn1
How to mitigate CVE-2026-119197
Install security update from vendor's website.
py-asn1 - update to 0.6.5