CVE-2026-119196

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts...

CVE-2026-119196 pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts...

CVE-2026-119196

The pyasn1 Python library (prior to version 0.6.5 ) is vulnerable to a quadratic CPU consumption issue during constructed BIT STRING decoding . The BitStringPayloadDecoder repeatedly calls BitString.fromOctetString, shifting and copying an ever-growing SizedInteger for each fragment in BER , CER ...

CGA-CX77-367V-PJ6R

Bulletin has no description...

CGA-FHGC-7Q7H-6RV7

Bulletin has no description...

CGA-25X8-P8XC-MW99

Bulletin has no description...

CVE-2026-119195 pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER reject...

CVE-2026-119195

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER reject...

CVE-2026-119195 pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER reject...

CVE-2026-119195 pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER reject...

CVE-2026-119195

The pyasn1 library for Python, versions prior to 0.6.5 , is vulnerable to a quadratic-time denial of service. The root cause is located in OctuetStringPayloadDecoder and AnyPayloadDecoder.indefLenValueDecoder , which repeatedly concatenate fragments onto a growing bytes value during constructed s...

CVE-2026-119194 pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long...

CVE-2026-119194

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long...

CVE-2026-119194 pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long...

CVE-2026-119194

The pyasn1 Python library (versions 0.3.3 through 0.6.5 ) is vulnerable to a quadratic CPU use issue during schemaless BER, CER, or DER container decoding. The root cause lies in the ConstructedPayloadDecoderBase._decodeComponentsSchemaless function, where the application stores every decoded com...

CGA-373M-XMV3-PH66

Bulletin has no description...

CGA-HWQ2-5C5J-77PM

Bulletin has no description...

CGA-8GM2-4PMV-GQR9

Bulletin has no description...

CVE-2026-119193

PHPUnit, a PHP testing framework, is vulnerable to arbitrary code execution in versions 13.4.0 through 13.4.4 . The root cause is located in the TestCase::coverageFilesDirectory() logic within src/Runner/Phpt/TestCase.php, which creates temporary files for PHPT code coverage in a predictable dire...

CVE-2026-119193 PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sysgettempdir and reuses that directory without verifying its...