Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119195— pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding

Quick assessment

Affected
pyasn1 pyasn1
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pyasn1 是 Python 的一个通用 ASN.1 库。在 0.6.5 版本之前，该库在解码构造型字符串和不定长度的 ANY 类型时，会反复将每个数据片段拼接到一个不断增长的字节值上。攻击者控制的 BER 或 CER 数据可利用大量构造型 OCTET STRING 或字符字符串片段触发此问题。DER 编码会拒绝没有 schema 的构造型 OCTET STRING，但在 asn1Spec 指定为 univ.OctetString 时会接受其定长形式；同时，即使在没有 schema 的情况下，DER 也会接受构造

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
pyasn1 pyasn1 < 0.6.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119195

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding
Source: CVE Program / CVE List V5
Vulnerability Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pyasn1 pyasn1 < 0.6.5 -

II. Public POCs for CVE-2026-119195

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119195

请登录查看更多情报信息。

Other References for CVE-2026-119195 (4)

Same Patch Batch · pyasn1 · 2026-10-29 · 4 CVEs total

CVE-2026-119197 7.5 HIGH pyasn1: Quadratic-complexity denial of service in binary REAL decoding
CVE-2026-119196 7.5 HIGH pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding
CVE-2026-119194 7.5 HIGH pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding

IV. Related Vulnerabilities

Same product: pyasn1
Same vendor: pyasn1
Same weakness: CWE-407