CVE-2026-119196

HIGH 7.5

pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.

CWE	CWE-407
Vendor	pyasn1
Product	pyasn1
Published	Oct 29, 2026

Stay Ahead of the Next One

Get instant alerts for pyasn1 pyasn1

Be the first to know when new high vulnerabilities affecting pyasn1 pyasn1 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

pyasn1 / pyasn1

< 0.6.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5 github.com: https://github.com/pyasn1/pyasn1/pull/132 github.com: https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c github.com: https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5