CVE-2026-119194
pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding
pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.
Fixes and workarounds
Fix
pyasn1 (PyPI): OSV reports a fixed version 0.6.5. Check the advisory for supported release branches.
Source: OSV GHSA-fm9c-5rcf-2q5pAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| pyasn1 pyasn1 |
>= 0.3.3, < 0.6.5 (affected) | CNA: GitHub_M |
pyasn1pyasn1
PyPI |
0.3.3 (affected, PyPI) 0.3.4 (affected, PyPI) 0.3.5 (affected, PyPI) 0.3.6 (affected, PyPI) 0.3.7 (affected, PyPI) 0.4.1 (affected, PyPI) 0.4.2 (affected, PyPI) 0.4.3 (affected, PyPI) 0.4.4 (affected, PyPI) 0.4.5 (affected, PyPI) 0.4.6 (affected, PyPI) 0.4.7 (affected, PyPI) 0.4.8 (affected, PyPI) 0.5.0 (affected, PyPI) 0.5.1 (affected, PyPI) 0.6.0 (affected, PyPI) 0.6.1 (affected, PyPI) 0.6.2 (affected, PyPI) 0.6.3 (affected, PyPI) 0.6.4 (affected, PyPI) Ecosystem version events: introduced 0.3.3; fixed 0.6.5 Source events (ECOSYSTEM)Other versions: unaffected |
OSV GHSA-fm9c-5rcf-2q5p |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA: GitHub_M |
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD: [email protected] |
Exploit evidence
- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p
exploit · ADP: CISA-ADP
References
- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5pCNA: GitHub_M · x_refsource_CONFIRM
- https://github.com/pyasn1/pyasn1/pull/132CNA: GitHub_M · x_refsource_MISC
- https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86CNA: GitHub_M · x_refsource_MISC
- https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5CNA: GitHub_M · x_refsource_MISC
- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5pADP: CISA-ADP · exploit
- https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86[email protected]
- https://github.com/pyasn1/pyasn1/pull/132[email protected]
- https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5[email protected]
- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p[email protected]
- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://github.com/advisories/GHSA-fm9c-5rcf-2q5pOSV / GitHub Security Advisories · advisory
- https://osv.dev/vulnerability/GHSA-fm9c-5rcf-2q5pOSV / GitHub Security Advisories · osv
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.