{"id":"CVE-2026-119197","aliases":["AZL-111539","DEBIAN-CVE-2026-119197","EUVD-2026-113353","GHSA-mm57-4v3p-rchx","OESA-2026-4786","OESA-2026-4787","OESA-2026-4788","OESA-2026-4789","UBUNTU-CVE-2026-119197","USN-9011-1"],"status":"published","title":"pyasn1: Quadratic-complexity denial of service in binary REAL decoding","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00425,"percentile":0.37241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2026-10-29T19:48:52Z","modified":"2026-11-11T12:45:11Z","fixes":[{"ecosystem":"PyPI","package":"pyasn1","fixed_in":["0.6.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"pyasn1","fixed_in":["0.6.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pyasn1","fixed_in":["0.1.7-1ubuntu2.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pyasn1","fixed_in":["0.1.9-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pyasn1","fixed_in":["0.4.2-3ubuntu0.18.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pyasn1","fixed_in":["0.4.2-3ubuntu0.20.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"pyasn1","fixed_in":["0.4.8-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"pyasn1","fixed_in":["0.4.8-4ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"pyasn1","fixed_in":["0.6.4-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"pyasn1","fixed_in":["0.6.3-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.6.4"},{"fixed":"0.6.5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.8-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.8-3","0.4.8-3+deb12u1","0.4.8-3+deb12u2","0.4.8-3+deb12u3","0.4.8-4","0.5.1-1","0.6.0-1","0.6.1-1","0.6.2-1","0.6.2-1~bpo13+1","0.6.3-1","0.6.4-1","0.6.4-1~bpo13+1","0.6.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.1-1","0.6.1-1+deb13u1","0.6.1-1+deb13u2","0.6.1-1+deb13u3","0.6.2-1","0.6.2-1~bpo13+1","0.6.3-1","0.6.4-1","0.6.4-1~bpo13+1","0.6.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.5-1"}]}],"versions":["0.6.1-1","0.6.2-1","0.6.2-1~bpo13+1","0.6.3-1","0.6.4-1","0.6.4-1~bpo13+1"]},{"source":"osv","ecosystem":"PyPI","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.5"}]}],"versions":["0.0.10a","0.0.11a","0.0.12a","0.0.13","0.0.13a","0.0.13b","0.0.6a","0.0.9a","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.1","0.2.2","0.2.3","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.5.0","0.5.1","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1-5.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1-5.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1-5.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-8.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.7-1ubuntu2.1+esm2"}]}],"versions":["0.1.4-0ubuntu1","0.1.7-1ubuntu1","0.1.7-1ubuntu2","0.1.7-1ubuntu2.1","0.1.7-1ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9-1ubuntu0.1~esm2"}]}],"versions":["0.1.8-2","0.1.9-1","0.1.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-3ubuntu0.18.04.1~esm2"}]}],"versions":["0.1.9-2","0.4.2-3","0.4.2-3ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-3ubuntu0.20.04.1~esm2"}]}],"versions":["0.4.2-3","0.4.2-3build1","0.4.2-3ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-1ubuntu0.4"}]}],"versions":["0.4.8-1","0.4.8-1ubuntu0.1","0.4.8-1ubuntu0.2","0.4.8-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-4ubuntu0.4"}]}],"versions":["0.4.8-4","0.4.8-4ubuntu0.1","0.4.8-4ubuntu0.2","0.4.8-4ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4-1ubuntu0.1"}]}],"versions":["0.6.3-1","0.6.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-1ubuntu0.2"}]}],"versions":["0.6.1-1","0.6.1-1build1","0.6.2-1","0.6.3-1","0.6.3-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.7-1ubuntu2.1+esm2"}]}],"versions":["0.1.4-0ubuntu1","0.1.7-1ubuntu1","0.1.7-1ubuntu2","0.1.7-1ubuntu2.1","0.1.7-1ubuntu2.1+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.9-1ubuntu0.1~esm2"}]}],"versions":["0.1.8-2","0.1.9-1","0.1.9-1ubuntu0.1~esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-3ubuntu0.18.04.1~esm2"}]}],"versions":["0.1.9-2","0.4.2-3","0.4.2-3ubuntu0.18.04.1~esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-3ubuntu0.20.04.1~esm2"}]}],"versions":["0.4.2-3","0.4.2-3build1","0.4.2-3ubuntu0.20.04.1~esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-1ubuntu0.4"}]}],"versions":["0.4.8-1","0.4.8-1ubuntu0.1","0.4.8-1ubuntu0.2","0.4.8-1ubuntu0.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.8-4ubuntu0.4"}]}],"versions":["0.4.8-4","0.4.8-4ubuntu0.1","0.4.8-4ubuntu0.2","0.4.8-4ubuntu0.3"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4-1ubuntu0.1"}]}],"versions":["0.6.3-1","0.6.4-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-1ubuntu0.2"}]}],"versions":["0.6.1-1","0.6.1-1build1","0.6.2-1","0.6.3-1","0.6.3-1ubuntu0.1"],"bundled":7}],"products":[{"vendor":"pyasn1","product":"pyasn1"}],"references":[{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/pyasn1/pyasn1/pull/132","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119197","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mm57-4v3p-rchx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119197.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-119197","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119196","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4787","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4788","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4789","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-119197","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-119197","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-9011-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-119194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-119195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-119196","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-119197","title":"pyasn1: Quadratic-complexity denial of service in binary REAL decoding","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","status":"published","published":"2026-10-29T19:48:52.47Z","modified":"2026-10-30T16:08:50.12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:20:10.143031Z"}],"euvd":[{"id":"EUVD-2026-113353","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","status":"published","published":"2026-10-29T19:48:52Z","modified":"2026-10-30T16:08:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:05.913237Z"}],"ghsa":[{"id":"GHSA-mm57-4v3p-rchx","title":"pyasn1 has quadratic-complexity denial of service in binary REAL decoding","description":"## Summary\n\nIn pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time quadratic in the mantissa length. The BER, CER, and DER decoders all use the affected `RealPayloadDecoder`. An application is exposed when it passes attacker-controlled ASN.1 containing a REAL value to one of these decoders, either without an `asn1Spec` or with a schema that includes REAL. The work occurs inside `decode()`; the application does not need to convert, print, or otherwise use the resulting REAL object.\n\nThis is distinct from [CVE-2026-59886](https://github.com/advisories/GHSA-hm4w-wwcw-mr6r), which concerns converting an already-decoded REAL to a Python float. That issue was fixed in 0.6.4 and its advisory states that decoding alone does not trigger it.\n\n## Root cause and affected components\n\nFor binary REAL values, [`RealPayloadDecoder.valueDecoder` in v0.6.4](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L535-L603) builds the mantissa one octet at a time:\n\n```python\np = 0\nwhile chunk:\n    p \u003c\u003c= 8\n    p |= chunk[0]\n    chunk = chunk[1:]\n```\n\nEach shift processes an integer that grows with the mantissa; with byte strings, each slice also copies the remaining suffix. Repeating both operations for every octet makes decoding quadratic in mantissa size. The decoder's [eight-octet length-field limit](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L1704-L1717) does not impose a practical mantissa-size limit for the inputs demonstrated below. [CER](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/cer/decoder.py#L51-L62) and [DER](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/der/decoder.py#L23-L31) reuse the BER REAL payload decoder, so all three paths reach this loop.\n\nThe vulnerable loop is present in every available repository release tag inspected, from v0.2.1 through v0.6.4. Runtime measurements below were made on v0.6.4; older releases were checked for the loop, not benchmarked individually.\n\n## Impact\n\nA comparatively small REAL value can hold a decoder worker on one CPU core for seconds or longer. The attacker must be able to supply data that the application sends to an affected decoder, and application-level input limits may reduce exposure. The demonstrated effect is CPU exhaustion during decoding; this advisory does not assert a network endpoint, unauthenticated access, or an affected downstream application by itself.\n\n## Reproduction and evidence\n\nThe following example uses pyasn1 0.6.4. The `0x09` tag identifies REAL; `0x80 0x00` selects a positive, base-2 binary value with a one-octet zero exponent, followed by a large mantissa. It exercises `decode()` only.\n\n```python\nimport time\n\nfrom pyasn1.codec.ber import decoder as ber\nfrom pyasn1.codec.cer import decoder as cer\nfrom pyasn1.codec.der import decoder as der\n\n\ndef real_value(mantissa_octets):\n    content = b\"\\x80\\x00\" + b\"\\xff\" * mantissa_octets\n    length = len(content).to_bytes(3, \"big\")\n    return b\"\\x09\\x83\" + length + content\n\n\nfor codec in (ber, cer, der):\n    for size in (50_000, 100_000, 200_000):\n        substrate = real_value(size)\n        started = time.process_time()\n        value, rest = codec.decode(substrate)\n        print(codec.__name__, size, time.process_time() - started)\n        assert not rest\n        assert tuple(value)[1:] == (2, 0)\n```\n\nThe original report measured the following BER CPU times on repository commit `aa05757`. That commit is later than the official v0.6.4 tag; the vulnerable loop is identical in the tagged release.\n\n| Mantissa size | Reporter's BER CPU time |\n| ---: | ---: |\n| 50,000 octets | 0.328 s |\n| 100,000 octets | 1.299 s |\n| 200,000 octets | 6.043 s |\n| 400,000 octets | 24.095 s |\n\nThe same report measured 5.645 s for a 200,000-octet mantissa through DER.\n\nA separate local reproduction on the official v0.6.4 tag (`d43496f`, CPython 3.14.8, macOS arm64) measured BER at 0.209 s, 0.884 s, and 3.451 s for 50,000, 100,000, and 200,000 mantissa octets respectively. CER and DER each took about 0.89 s at 100,000 octets. These are machine-specific measurements; the repeated near-fourfold cost for doubled input is the relevant result. Neither reproduction calls `float()`, `str()`, or `prettyPrint()`.\n\n## Fix\n\npyasn1 0.6.5 replaces the per-octet shift and slice loop with one `int.from_bytes(bytes(chunk), \"big\")` conversion. Sign, scale, exponent, and the decoded REAL tuple are preserved. The fix is in the shared BER payload decoder and therefore covers BER, CER, and DER. A local check of the 0.6.5 candidate decoded a 200,000-octet mantissa correctly through all three codecs; the check does not establish behavior for every application using REAL.\n\n## Workarounds\n\nUpgrade to pyasn1 0.6.5. Until then, reject or strictly limit attacker-controlled ASN.1 input that may contain REAL values before passing it to pyasn1. The appropriate size limit depends on the application's available CPU time and request volume.","status":"published","published":"2026-10-30T23:06:46Z","modified":"2026-10-30T23:06:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:41:42.013329Z"}],"nvd":[{"id":"CVE-2026-119197","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","status":"published","published":"2026-10-29T20:17:30.907Z","modified":"2026-10-30T17:18:03.88Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:13:04.940026Z"}],"osv":[{"id":"CVE-2026-119197","title":"pyasn1: Quadratic-complexity denial of service in binary REAL decoding","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","status":"published","published":"2026-10-29T19:48:52.47Z","modified":"2026-11-01T02:47:27.350640438Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:44:57.008854Z"},{"id":"DEBIAN-CVE-2026-119197","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","status":"published","published":"2026-10-29T20:17:30.907Z","modified":"2026-11-03T10:00:20.077501472Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"GHSA-mm57-4v3p-rchx","title":"pyasn1 has quadratic-complexity denial of service in binary REAL decoding","description":"## Summary\n\nIn pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time quadratic in the mantissa length. The BER, CER, and DER decoders all use the affected `RealPayloadDecoder`. An application is exposed when it passes attacker-controlled ASN.1 containing a REAL value to one of these decoders, either without an `asn1Spec` or with a schema that includes REAL. The work occurs inside `decode()`; the application does not need to convert, print, or otherwise use the resulting REAL object.\n\nThis is distinct from [CVE-2026-59886](https://github.com/advisories/GHSA-hm4w-wwcw-mr6r), which concerns converting an already-decoded REAL to a Python float. That issue was fixed in 0.6.4 and its advisory states that decoding alone does not trigger it.\n\n## Root cause and affected components\n\nFor binary REAL values, [`RealPayloadDecoder.valueDecoder` in v0.6.4](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L535-L603) builds the mantissa one octet at a time:\n\n```python\np = 0\nwhile chunk:\n    p \u003c\u003c= 8\n    p |= chunk[0]\n    chunk = chunk[1:]\n```\n\nEach shift processes an integer that grows with the mantissa; with byte strings, each slice also copies the remaining suffix. Repeating both operations for every octet makes decoding quadratic in mantissa size. The decoder's [eight-octet length-field limit](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/ber/decoder.py#L1704-L1717) does not impose a practical mantissa-size limit for the inputs demonstrated below. [CER](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/cer/decoder.py#L51-L62) and [DER](https://github.com/pyasn1/pyasn1/blob/v0.6.4/pyasn1/codec/der/decoder.py#L23-L31) reuse the BER REAL payload decoder, so all three paths reach this loop.\n\nThe vulnerable loop is present in every available repository release tag inspected, from v0.2.1 through v0.6.4. Runtime measurements below were made on v0.6.4; older releases were checked for the loop, not benchmarked individually.\n\n## Impact\n\nA comparatively small REAL value can hold a decoder worker on one CPU core for seconds or longer. The attacker must be able to supply data that the application sends to an affected decoder, and application-level input limits may reduce exposure. The demonstrated effect is CPU exhaustion during decoding; this advisory does not assert a network endpoint, unauthenticated access, or an affected downstream application by itself.\n\n## Reproduction and evidence\n\nThe following example uses pyasn1 0.6.4. The `0x09` tag identifies REAL; `0x80 0x00` selects a positive, base-2 binary value with a one-octet zero exponent, followed by a large mantissa. It exercises `decode()` only.\n\n```python\nimport time\n\nfrom pyasn1.codec.ber import decoder as ber\nfrom pyasn1.codec.cer import decoder as cer\nfrom pyasn1.codec.der import decoder as der\n\n\ndef real_value(mantissa_octets):\n    content = b\"\\x80\\x00\" + b\"\\xff\" * mantissa_octets\n    length = len(content).to_bytes(3, \"big\")\n    return b\"\\x09\\x83\" + length + content\n\n\nfor codec in (ber, cer, der):\n    for size in (50_000, 100_000, 200_000):\n        substrate = real_value(size)\n        started = time.process_time()\n        value, rest = codec.decode(substrate)\n        print(codec.__name__, size, time.process_time() - started)\n        assert not rest\n        assert tuple(value)[1:] == (2, 0)\n```\n\nThe original report measured the following BER CPU times on repository commit `aa05757`. That commit is later than the official v0.6.4 tag; the vulnerable loop is identical in the tagged release.\n\n| Mantissa size | Reporter's BER CPU time |\n| ---: | ---: |\n| 50,000 octets | 0.328 s |\n| 100,000 octets | 1.299 s |\n| 200,000 octets | 6.043 s |\n| 400,000 octets | 24.095 s |\n\nThe same report measured 5.645 s for a 200,000-octet mantissa through DER.\n\nA separate local reproduction on the official v0.6.4 tag (`d43496f`, CPython 3.14.8, macOS arm64) measured BER at 0.209 s, 0.884 s, and 3.451 s for 50,000, 100,000, and 200,000 mantissa octets respectively. CER and DER each took about 0.89 s at 100,000 octets. These are machine-specific measurements; the repeated near-fourfold cost for doubled input is the relevant result. Neither reproduction calls `float()`, `str()`, or `prettyPrint()`.\n\n## Fix\n\npyasn1 0.6.5 replaces the per-octet shift and slice loop with one `int.from_bytes(bytes(chunk), \"big\")` conversion. Sign, scale, exponent, and the decoded REAL tuple are preserved. The fix is in the shared BER payload decoder and therefore covers BER, CER, and DER. A local check of the 0.6.5 candidate decoded a 200,000-octet mantissa correctly through all three codecs; the check does not establish behavior for every application using REAL.\n\n## Workarounds\n\nUpgrade to pyasn1 0.6.5. Until then, reject or strictly limit attacker-controlled ASN.1 input that may contain REAL values before passing it to pyasn1. The appropriate size limit depends on the application's available CPU time and request volume.","status":"published","published":"2026-10-30T23:06:46Z","modified":"2026-10-30T23:15:06.62058781Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"OESA-2026-4786","title":"python-pyasn1 security update","description":"Abstract Syntax Notation One (ASN.1) is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python.\r\n\r\nSecurity Fix(es):\n\npyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component\u0026apos;s TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.(CVE-2026-119194)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.(CVE-2026-119195)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.(CVE-2026-119196)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.(CVE-2026-119197)","status":"published","published":"2026-11-11T12:26:09Z","modified":"2026-11-11T12:45:11.084248728Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4787","title":"python-pyasn1 security update","description":"Abstract Syntax Notation One (ASN.1) is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python.\r\n\r\nSecurity Fix(es):\n\npyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component\u0026apos;s TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.(CVE-2026-119194)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.(CVE-2026-119195)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.(CVE-2026-119196)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.(CVE-2026-119197)","status":"published","published":"2026-11-11T12:26:09Z","modified":"2026-11-11T12:45:03.182962994Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4788","title":"python-pyasn1 security update","description":"Abstract Syntax Notation One (ASN.1) is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python.\r\n\r\nSecurity Fix(es):\n\npyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component\u0026apos;s TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.(CVE-2026-119194)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.(CVE-2026-119195)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.(CVE-2026-119196)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.(CVE-2026-119197)","status":"published","published":"2026-11-11T12:26:10Z","modified":"2026-11-11T12:45:06.691643578Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4789","title":"python-pyasn1 security update","description":"Abstract Syntax Notation One (ASN.1) is a technology for exchanging structured data in a universally understood, hardware agnostic way. Many industrial, security and telephony applications heavily rely on ASN.1. The pyasn1 library implements ASN.1 support in pure-Python.\r\n\r\nSecurity Fix(es):\n\npyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component\u0026apos;s TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.(CVE-2026-119194)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.(CVE-2026-119195)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.(CVE-2026-119196)\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.(CVE-2026-119197)","status":"published","published":"2026-11-11T12:26:11Z","modified":"2026-11-11T12:45:06.747288033Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"UBUNTU-CVE-2026-119197","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","status":"published","published":"2026-10-29T20:17:00Z","modified":"2026-11-11T09:37:13.486413309Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T10:01:18.620522Z"},{"id":"AZL-111539","title":"CVE-2026-119197 affecting package python-pyasn1 0.4.8-3","description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","status":"published","published":"2026-10-29T20:17:30Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"USN-9011-1","title":"pyasn1 vulnerabilities","description":"It was discovered that pyasn1 did not properly bound the size of long-form\ntag identifiers when parsing BER, CER, or DER encoded data. An attacker\ncould possibly use this issue to cause applications decoding untrusted\nASN.1 data to consume excessive CPU resources, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59884)\n\nIt was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID\nvalues in quadratic time relative to the number of arcs. An attacker could\npossibly use this issue to cause applications decoding untrusted ASN.1 data\nto consume excessive CPU resources, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nand Ubuntu 20.04 LTS. (CVE-2026-59885)\n\nIt was discovered that pyasn1 incorrectly handled conversion of decoded\nREAL values to Python float types. An attacker could possibly use this\nissue to cause applications decoding untrusted ASN.1 data to consume\nexcessive CPU and memory resources, resulting in a denial of service. This\nissue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nand Ubuntu 20.04 LTS. (CVE-2026-59886)\n\nIt was discovered that pyasn1 incorrectly handled tracking component types\nwhen decoding containers without a schema. An attacker could possibly use\nthis issue to cause applications decoding untrusted ASN.1 data to consume\nexcessive CPU resources, resulting in a denial of service. This issue only\naffected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04\nLTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119194)\n\nIt was discovered that pyasn1 processed fragmented constructed strings and\nindefinite-length ANY values in quadratic time. An attacker could possibly\nuse this issue to cause applications decoding untrusted ASN.1 data to\nconsume excessive CPU resources, resulting in a denial of service. This\nissue was only addressed in Ubuntu 26.04 LTS and Ubuntu 26.10.\n(CVE-2026-119195)\n\nIt was discovered that pyasn1 processed fragmented constructed BIT STRING\nvalues in quadratic time. An attacker could possibly use this issue to\ncause applications decoding untrusted ASN.1 data to consume excessive CPU\nresources, resulting in a denial of service. (CVE-2026-119196)\n\nIt was discovered that pyasn1 processed binary-encoded REAL values with\nlarge mantissas in quadratic time. An attacker could possibly use this\nissue to cause applications decoding untrusted ASN.1 data to consume\nexcessive CPU resources, resulting in a denial of service.\n(CVE-2026-119197)","status":"published","published":"2026-11-09T16:15:14Z","modified":"2026-11-11T09:34:57.290482225Z","updated_at":"2026-11-10T03:21:46.325253Z"}]}}