{"affected":[{"product":"pyasn1","source":"CNA: GitHub_M","vendor":"pyasn1","versions":[{"status":"affected","version":"< 0.6.5"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"pyasn1","product":"pyasn1","source":"OSV GHSA-2qm8-x737-gmw5","vendor":"","versions":[{"status":"affected","version":"0.0.10a","versionType":"PyPI"},{"status":"affected","version":"0.0.11a","versionType":"PyPI"},{"status":"affected","version":"0.0.12a","versionType":"PyPI"},{"status":"affected","version":"0.0.13","versionType":"PyPI"},{"status":"affected","version":"0.0.13a","versionType":"PyPI"},{"status":"affected","version":"0.0.13b","versionType":"PyPI"},{"status":"affected","version":"0.0.6a","versionType":"PyPI"},{"status":"affected","version":"0.0.9a","versionType":"PyPI"},{"status":"affected","version":"0.1.1","versionType":"PyPI"},{"status":"affected","version":"0.1.2","versionType":"PyPI"},{"status":"affected","version":"0.1.3","versionType":"PyPI"},{"status":"affected","version":"0.1.4","versionType":"PyPI"},{"status":"affected","version":"0.1.5","versionType":"PyPI"},{"status":"affected","version":"0.1.6","versionType":"PyPI"},{"status":"affected","version":"0.1.7","versionType":"PyPI"},{"status":"affected","version":"0.1.8","versionType":"PyPI"},{"status":"affected","version":"0.1.9","versionType":"PyPI"},{"status":"affected","version":"0.2.1","versionType":"PyPI"},{"status":"affected","version":"0.2.2","versionType":"PyPI"},{"status":"affected","version":"0.2.3","versionType":"PyPI"},{"status":"affected","version":"0.3.1","versionType":"PyPI"},{"status":"affected","version":"0.3.2","versionType":"PyPI"},{"status":"affected","version":"0.3.3","versionType":"PyPI"},{"status":"affected","version":"0.3.4","versionType":"PyPI"},{"status":"affected","version":"0.3.5","versionType":"PyPI"},{"status":"affected","version":"0.3.6","versionType":"PyPI"},{"status":"affected","version":"0.3.7","versionType":"PyPI"},{"status":"affected","version":"0.4.1","versionType":"PyPI"},{"status":"affected","version":"0.4.2","versionType":"PyPI"},{"status":"affected","version":"0.4.3","versionType":"PyPI"},{"status":"affected","version":"0.4.4","versionType":"PyPI"},{"status":"affected","version":"0.4.5","versionType":"PyPI"},{"status":"affected","version":"0.4.6","versionType":"PyPI"},{"status":"affected","version":"0.4.7","versionType":"PyPI"},{"status":"affected","version":"0.4.8","versionType":"PyPI"},{"status":"affected","version":"0.5.0","versionType":"PyPI"},{"status":"affected","version":"0.5.1","versionType":"PyPI"},{"status":"affected","version":"0.6.0","versionType":"PyPI"},{"status":"affected","version":"0.6.1","versionType":"PyPI"},{"status":"affected","version":"0.6.2","versionType":"PyPI"},{"status":"affected","version":"0.6.3","versionType":"PyPI"},{"status":"affected","version":"0.6.4","versionType":"PyPI"},{"events":[{"introduced":"0"},{"fixed":"0.6.5"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-119196","cwes":["CWE-407"],"description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.","epss":{"date":"2026-11-03","percentile":0.36842,"score":0.00425},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5"}],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793756446787,"publishedAt":1793303086031,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/pyasn1/pyasn1/pull/132"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-2qm8-x737-gmw5"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-2qm8-x737-gmw5"}],"remediation":[{"kind":"fix","source":"OSV GHSA-2qm8-x737-gmw5","text":"pyasn1 (PyPI): OSV reports a fixed version 0.6.5. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-2qm8-x737-gmw5"}],"revision":"05ed63f4eb079862eac3db4e8b7f2c82c019cfa3a91357d42c9a80b6f83313e9","sources":[{"modifiedAt":1793756446787,"name":"CNA: GitHub_M","retrievedAt":1793758141882,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119196"},{"modifiedAt":1793402104525,"name":"OSV / GitHub Security Advisories","retrievedAt":1793758142950,"url":"https://osv.dev/vulnerability/GHSA-2qm8-x737-gmw5"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793758171534,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-119196"}],"ssvc":{"assessedAt":1793756425017,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding","updatedAt":1793758171534}