Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119197— pyasn1: Quadratic-complexity denial of service in binary REAL decoding

Quick assessment

Affected

pyasn1 pyasn1

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pyasn1 是一个用于 Python 的通用 ASN.1 库。在 0.6.5 版本之前，二进制 REAL 类型的解码过程会逐字节构建一个巨大的尾数（mantissa），其实现方式是对一个不断增长的整数执行移位操作，并截取剩余的字节串。攻击者可构造包含大尾数二进制编码 REAL 值的 ASN.1 数据，并触发 BER、CER 或 DER 的 decode() 方法（无论是否提供包含 REAL 类型的 Schema）。RealPayloadDecoder.valueDecoder 会对尾数的每一个字节重复执行左移、按

CVSS 7.5 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1499.001 · OS Exhaustion Flood

Affected Version Matrix 1

Vendor	Product	Version Range	Status
pyasn1	pyasn1	`< 0.6.5`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

pyasn1: Quadratic-complexity denial of service in binary REAL decoding

Source: CVE Program / CVE List V5

Vulnerability Description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

算法复杂性

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pyasn1	pyasn1	< 0.6.5	-

II. Public POCs for CVE-2026-119197

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119197

请登录查看更多情报信息。

Other References for CVE-2026-119197 (4)

https://github.com/pyasn1/pyasn1/pull/132 x_refsource_MISC
https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5 x_refsource_MISC
https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx x_refsource_CONFIRM
https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119197

Same Patch Batch · pyasn1 · 2026-10-29 · 4 CVEs total

CVE-2026-119196	7.5 HIGH	pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding
CVE-2026-119194	7.5 HIGH	pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding
CVE-2026-119195	7.5 HIGH	pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY d

IV. Related Vulnerabilities

Same product: pyasn1

Same vendor: pyasn1

Same weakness: CWE-407