86 matches found
SUSE CVE-2026-119195
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER reject...
pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding
Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies the entire value accumulated so far. For fixed-size fragments, CPU time grows quadratically with the encoded input size. An application that passes sufficiently large,...
GHSA-2QM8-X737-GMW5 pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding
Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies the entire value accumulated so far. For fixed-size fragments, CPU time grows quadratically with the encoded input size. An application that passes sufficiently large,...
EUVD-2026-113353
pyasn1 has quadratic-complexity denial of service in binary REAL decoding...
pyasn1 has quadratic-complexity denial of service in binary REAL decoding
Summary In pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time quadratic in the mantissa length. The BER, CER, and DER decoders all use the affected RealPayloadDecoder. An application is exposed when it passes attacker-controlled ASN.1...
GHSA-MM57-4V3P-RCHX pyasn1 has quadratic-complexity denial of service in binary REAL decoding
Summary In pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time quadratic in the mantissa length. The BER, CER, and DER decoders all use the affected RealPayloadDecoder. An application is exposed when it passes attacker-controlled ASN.1...
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding
Summary In pyasn1 0.6.4 and earlier, decoding a constructed OCTET STRING or character string made of many fragments can spend disproportionate CPU time repeatedly copying the accumulated value. A separate indefinite-length ANY path has the same problem while collecting the encoded components. The...
GHSA-9M75-VC3G-4X39 pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding
Summary In pyasn1 0.6.4 and earlier, decoding a constructed OCTET STRING or character string made of many fragments can spend disproportionate CPU time repeatedly copying the accumulated value. A separate indefinite-length ANY path has the same problem while collecting the encoded components. The...
EUVD-2026-113351
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding...
Inefficient Algorithmic Complexity
Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the ConstructedPayloadDecoderBase.decodeComponentsSchemaless method in pyasn1/codec/ber/decoder.py. An attacker can exhaust CPU during a schemaless decode of a BER, CER, or DER container by supplyin...
GHSA-FM9C-5RCF-2Q5P pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding
Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container with many distinct long tag IDs can cause quadratic CPU use. Repeated inputs can exhaust CPU and reduce service availability. Details...
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding
Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container with many distinct long tag IDs can cause quadratic CPU use. Repeated inputs can exhaust CPU and reduce service availability. Details...
EUVD-2026-113350
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding...
Linux Distros Unpatched Vulnerability : CVE-2026-119195
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a...
Linux Distros Unpatched Vulnerability : CVE-2026-119196
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated fr...
CVE-2026-119196
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts...
DEBIAN-CVE-2026-119195
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER reject...
DEBIAN-CVE-2026-119196
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts...
AZL-111536 CVE-2026-119196 affecting package python-pyasn1 0.4.8-3
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts...
AZL-111533 CVE-2026-119195 affecting package python-pyasn1 0.4.8-3
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER reject...