Skip to content

CVE-2026-119196 · CVE record: PUBLISHED

pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding

pyasn1 pyasn1

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.

Exploitation evidence

Not listed in the latest downloaded CISA KEV catalog. This does not establish an absence of exploitation.

KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗

Reported products and versions

pyasn1 / pyasn1

Default status: Not specified

affected: < 0.6.5

Fixes and workarounds

No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.

Sources and related reporting

CVE Program record ↗ · Download tracked evidence as JSON

Monitored source mentions

GitHub Advisory Database — pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding ↗

Shared CVE identifiers link source mentions; they do not establish that the reports describe the same incident.

Observed change timeline

History begins when Egret first downloads each source. It is not the complete upstream CVE history.

12 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-12",
  "epss": 0.00425,
  "percentile": 0.37276
}

10 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-10",
  "epss": 0.00425,
  "percentile": 0.37116
}

09 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-09",
  "epss": 0.00425,
  "percentile": 0.37074
}

08 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-08",
  "epss": 0.00425,
  "percentile": 0.37058
}

07 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-07",
  "epss": 0.00425,
  "percentile": 0.37039
}

06 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-06",
  "epss": 0.00425,
  "percentile": 0.36985
}

06 Nov 2026, 06:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-05",
  "epss": 0.00425,
  "percentile": 0.36965
}

04 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-04",
  "epss": 0.00425,
  "percentile": 0.36946
}

04 Nov 2026, 12:20 Jerusalem · CVE Program record changed

Stored CNA snapshot at this observation.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119196",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T01:40:25.017112Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T01:40:46.787Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyasn1",
          "vendor": "pyasn1",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.6.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T19:44:46.031Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/pull/132",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/pull/132"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"
        }
      ],
      "source": {
        "advisory": "GHSA-2qm8-x737-gmw5",
        "discovery": "UNKNOWN"
      },
      "title": "pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119196",
    "datePublished": "2026-10-29T19:44:46.031Z",
    "dateReserved": "2026-10-29T16:04:48.728Z",
    "dateUpdated": "2026-11-04T01:40:46.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

03 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-03",
  "epss": 0.00425,
  "percentile": 0.36842
}

03 Nov 2026, 06:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-02",
  "epss": 0.00425,
  "percentile": 0.36797
}

03 Nov 2026, 06:20 Jerusalem · CVE Program record changed

Stored CNA snapshot at this observation.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pyasn1",
          "vendor": "pyasn1",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.6.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T19:44:46.031Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/pull/132",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/pull/132"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c"
        },
        {
          "name": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"
        }
      ],
      "source": {
        "advisory": "GHSA-2qm8-x737-gmw5",
        "discovery": "UNKNOWN"
      },
      "title": "pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119196",
    "datePublished": "2026-10-29T19:44:46.031Z",
    "dateReserved": "2026-10-29T16:04:48.728Z",
    "dateUpdated": "2026-10-29T19:44:46.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Egret — Back to top Egret