Skip to content
OpenAdvisories
High · 7.5 CVE-2026-119194 EUVD-2026-113350GHSA-fm9c-5rcf-2q5p

pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding

Published Oct 29, 2026 · Updated Nov 3, 2026 · Assigned by GitHub_M

Description

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.

Affected products

VendorProductAffectedFixed
pyasn1 pyasn1 >= 0.3.3, < 0.6.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 pyasn1 0.6.5-1 —
Debian 13 pyasn1 No fix yet —
Debian 12 pyasn1 No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 pyasn1 0.6.4-1ubuntu0.1 USN-9011-1
Ubuntu 26.04 LTS pyasn1 0.6.3-1ubuntu0.2 USN-9011-1
Ubuntu 24.04 LTS pyasn1 0.4.8-4ubuntu0.4 USN-9011-1
Ubuntu 22.04 LTS pyasn1 0.4.8-1ubuntu0.4 USN-9011-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS pyasn1 0.4.2-3ubuntu0.20.04.1~esm2 USN-9011-1
Ubuntu Pro 18.04 LTS pyasn1 0.4.2-3ubuntu0.18.04.1~esm2 USN-9011-1
Ubuntu Pro 16.04 LTS pyasn1 0.1.9-1ubuntu0.1~esm2 USN-9011-1
Ubuntu Pro 14.04 LTS pyasn1 0.1.7-1ubuntu2.1+esm2 USN-9011-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-pyasn1 0.6.5-1.1 openSUSE-SU-2026:12491-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3-pyasn1 +2 0.4.8-4.amzn2023.0.6 ALAS2023-2026-3438

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-pyasn1 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling kubeflow-pipelines-apiserver 2.18.0-r1 —
Wolfi rolling kubeflow-pipelines-visualization-server 2.18.0-r2 —
Wolfi rolling superset-6.0 No fix yet —
Wolfi rolling superset-6.1 6.1.0-r24 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI pyasn1 >= 0.3.3, < 0.6.5 0.6.5 GHSA-fm9c-5rcf-2q5p

Advisories 3

References