pyasn1 up to 0.6.4 ASN.1 Decoding AnyPayloadDecoder.indefLenValueDecoder resource consumption

Summaryinfo

A vulnerability has been found in pyasn1 up to 0.6.4 and classified as problematic. The affected element is the function AnyPayloadDecoder.indefLenValueDecoder of the component ASN.1 Decoding. The manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-119195. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in pyasn1 up to 0.6.4. This issue affects the function AnyPayloadDecoder.indefLenValueDecoder of the component ASN.1 Decoding. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-119195 since 10/29/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 0.6.5 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• pyasn1

Version

• 0.6.0
• 0.6.1
• 0.6.2
• 0.6.3
• 0.6.4

Website

• Product: https://github.com/pyasn1/pyasn1/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion