CVE-2026-119195 in pyasn1
Summary
by MITRE • 10/29/2026
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The pyasn1 library serves as a generic ASN.1 implementation for Python, widely utilized in network protocols such as SNMP, LDAP, and X.509 certificate processing where Abstract Syntax Notation One encoding standards are prevalent. A critical performance vulnerability exists within the decoding logic of constructed strings and indefinite-length ANY types prior to version 0.6.5. This flaw stems from an inefficient algorithmic approach to handling fragmented data streams, specifically affecting how the library reconstructs byte sequences from multiple incoming chunks during BER or CER parsing operations.
The technical root cause lies in the implementation of OctetStringPayloadDecoder and AnyPayloadDecoder.indefLenValueDecoder. When processing constructed OCTET STRING or character-string fragments like UTF8String without a strict schema constraint, these decoders repeatedly concatenate each new fragment onto an existing growing bytes value. In Python, immutable byte strings require creating a new object in memory for every concatenation operation. Consequently, as the number of fragments increases, the library performs quadratic work by copying an increasingly large prefix with each step. This results in significant computational overhead and excessive CPU consumption proportional to the square of the input size rather than linearly.
The vulnerability is exploitable through attacker-controlled BER or CER data that contains a high volume of constructed OCTET STRING or character-string fragments. While DER encoding standards typically reject constructed OCTET STRING without a schema, pyasn1’s flexible parsing mode allows this when asn1Spec selects univ.OctetString. Similarly, the indefinite-length ANY path is reachable in BER and CER encodings when asn1Spec selects univ.Any, despite DER rejecting indefinite lengths for such types. This flexibility creates an attack surface where malicious actors can craft deeply fragmented ASN.1 structures to trigger the inefficient decoding behavior.
The operational impact of this vulnerability is a denial-of-service condition characterized by CPU exhaustion. An attacker can send a sufficiently large and highly fragmented payload that forces the decoder into quadratic time complexity, effectively hanging or crashing the processing worker threads responsible for parsing network traffic. This impacts availability but does not compromise confidentiality or integrity since no arbitrary code execution or data leakage occurs through this specific vector. The issue aligns with CWE-400, which covers uncontrolled resource consumption leading to denial of service, and can be mapped to ATT&CK technique T1496, representing Resource Hijacking where an attacker consumes system resources to degrade performance.
Mitigation requires upgrading pyasn1 to version 0.6.5 or later, where the decoding logic has been optimized to avoid repeated concatenation of growing prefixes. For systems unable to upgrade immediately, input validation should be implemented at the network perimeter to limit the size and fragmentation depth of ASN.1 structures before they reach the parser. Additionally, configuring timeouts for parsing operations can help mitigate the impact by terminating excessively long processing tasks that exhibit signs of quadratic behavior.