Zero Radar
← feed
HighVulnerabilityCVE-2026-119196updated 30 Oct 2026, 23:07 UTC

pyasn1 can use huge CPU time when decoding crafted ASN.1 data

pyasn1 is a Python library that reads a common data format used in certificates and security messages. A specially built input made of many small pieces can make it take a very long time to read, which can freeze the program that is reading

Fixed in pyasn1 0.6.5 · out Official, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yespyasn1 0.6.5 · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts inputMany small constructed BIT STRING fragments
  2. 2Input reaches appUntrusted BER, CER, or DER data
  3. 3pyasn1 decodes itRepeated shifting of growing value
  4. 4CPU exhaustedQuadratic work during decode()
  5. ResultDecoding thread stalls, denial of service

What happened

In pyasn1 0.6.4 and earlier, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies the entire accumulated value, causing quadratic CPU work during decode() for BER, CER, and schema-driven DER input.

Why it is dangerous: An attacker who can send crafted ASN.1 data to an affected application can tie up CPU and cause a denial of service; no later conversion of the value is needed to trigger it.

Are you affected?

You are affected if you use pyasn1 version 0.6.4 or earlier to decode untrusted BER, CER, or schema-driven DER input containing constructed BIT STRING values.

Package / productAffected versionsFixed in
pyasn1 · pip<= 0.6.40.6.5

What to do

  1. Update pyasn1 to version 0.6.5 or later (pip install --upgrade pyasn1)
  2. Check whether your application decodes untrusted ASN.1 input with pyasn1 and limit input size where possible until updated

Timeline

  1. 29 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 20:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 20:21 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 23:07 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 30 Oct 2026, 23:07 UTC
    Fixed version published: pyasn1 0.6.5 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-119196 · GHSA-2qm8-x737-gmw5
CVSS
7.5 / 10
Disclosed
29 Oct 2026, 20:17 UTC
On Zero Radar
29 Oct 2026, 20:21 UTC (4 min after disclosure)
Last change
30 Oct 2026, 23:07 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

pyasn1 can use huge CPU time when decoding crafted ASN.1 data · Zero Radar