CVE-2026-119196 in pyasn1
Summary
by MITRE • 10/29/2026
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The pyasn1 library serves as a generic ASN.1 implementation for the Python programming language, widely utilized in network protocols and data serialization tasks that rely on Abstract Syntax Notation One standards such as BER, CER, and DER. A critical performance vulnerability exists within the constructed BIT STRING decoding mechanism prior to version 0.6.5. This flaw stems from an inefficient algorithmic approach used by the BitStringPayloadDecoder when processing fragmented input streams. Specifically, the decoder repeatedly shifts and copies the entire accumulated bit value for each new fragment received during the parsing process.
The technical root cause lies in how the library handles constructed BIT STRING elements. When decoding BER or CER inputs that contain numerous constructed fragments, or schema-driven DER definite-length constructed BIT STRINGS, the BitStringPayloadDecoder invokes BitString.fromOctetString with the previously accumulated bit string as a prepend argument. This operation forces the creation of a new SizedInteger object for every fragment by concatenating the existing data with the new octets. As the number of fragments increases, this results in quadratic time complexity relative to the total size of the BIT STRING payload. The computational cost grows exponentially because each step involves copying and shifting an ever-growing integer value rather than appending or efficiently merging bit sequences.
This architectural inefficiency leads to a significant operational impact characterized by excessive CPU consumption during the decode phase. An attacker can exploit this behavior by crafting malicious ASN.1 payloads consisting of many small constructed BIT STRING fragments. Upon processing such input, the library enters an infinite loop-like state of intensive computation without necessarily requiring subsequent conversion or formatting steps. This effectively results in a Denial of Service condition where the application consuming pyasn1 becomes unresponsive due to CPU exhaustion. The vulnerability is particularly dangerous because it can be triggered remotely if the vulnerable parsing logic is exposed via network services, allowing for resource depletion attacks against systems relying on this library for protocol analysis or data ingestion.
To mitigate this risk, organizations must ensure that all instances of pyasn1 are upgraded to version 0.6.5 or later, where the decoding algorithm has been optimized to avoid quadratic complexity. Input validation and length restrictions should also be implemented at the application layer to limit the size of ASN.1 structures processed by vulnerable components. This vulnerability is categorized under CWE-400, which covers Uncontrolled Resource Consumption, as it allows an attacker to consume excessive computational resources through crafted input. In terms of offensive security frameworks, this aligns with MITRE ATT&CK technique T1496, Resource Hijacking, specifically involving CPU exhaustion via inefficient processing logic rather than cryptographic attacks or memory corruption.