Read the docs
TI-2026-82741 Aliases CVE-2026-119194GHSA-fm9c-5rcf-2q5p

Quadratic CPU use in pyasn1 schemaless BER/CER/DER decoding

Priority HIGH 72CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 23 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.

Summary

The pyasn1 Python library from 0.3.3 before 0.6.5 is affected. Schemaless container decoding keeps a growing set of tag sets, so crafted BER, CER or DER input makes later insertions slow through hash collisions, causing quadratic CPU work (CWE-407). A remote unauthenticated attacker can repeat such input to exhaust decoder CPU and reduce service availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00425 37th percentileScored 2026-11-07
Fix Partial pyasn1 (pyasn1): 0.6.5pyasn1 (PyPI): 0.6.5Red Hat: 1 advisoryRed Hat: 1 fixed, 23 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pyasn1pyasn10.3.3 to before 0.6.50.6.5Patch availableCNA
—pyasn1 (PyPI)0.3.3 to before 0.6.50.6.5Patch availableGHSA-fm9c-5rcf-2q5p
  • pyasn1 Vendorpyasn1 Affected 0.3.3 to before 0.6.5 Fixed in 0.6.5 Patch available CNA
  • pyasn1 (PyPI) Vendor— Affected 0.3.3 to before 0.6.5 Fixed in 0.6.5 Patch available GHSA-fm9c-5rcf-2q5p

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:*:*:*——pyasn1
  • cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:*:*:* Versions — — ·pyasn1

Remediation

Upgrade pyasn1 to version 0.6.5 on PyPI. Red Hat fixes Red Hat Trusted Artifact Signer 1.5 through RHSA-2026:95261. Red Hat has no remediation plan for Ansible Automation Orchestrator 2026, Exploit Intelligence, Fence Agents Remediation Operator, Lightspeed Core, Migration Toolkit for Applications 8 and other products.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA pyasn1 (pyasn1) Fixed in 0.6.5
  • Fix · GHSA-fm9c-5rcf-2q5p pyasn1 (PyPI) Fixed in 0.6.5 Advisory →

Red Hat 1 advisory

  • RHSA-2026:95261 Released 2026-11-04 · Red Hat rating Critical
    RHTAS 1.5.1 - Release of Model Transparency 1.0.6
    • Red Hat Trusted Artifact Signer 1.5 registry.redhat.io/rhtas/model-transparency-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Ansible Automation Orchestrator 2026AffectedNo fix yet
Exploit IntelligenceAffectedNo fix yet
Fence Agents Remediation OperatorAffectedNo fix yet
Lightspeed CoreAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
Migration Toolkit for ContainersAffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat OpenStack Platform 17.1AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat Trusted Artifact Signer 1.5Fixed RHSA-2026:95261
Not affected: 4 products
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift AI (RHOAI)
  • Service Telemetry Framework 1.5

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-119194
  2. 2026-10-30 Affected versions changed · Red Hat
  3. 2026-10-30 CVSS score added · Red Hat
  4. 2026-10-30 Alias added: GHSA-fm9c-5rcf-2q5p
  5. 2026-10-30 Fix available: PyPI/[email protected] · GHSA-fm9c-5rcf-2q5p
  6. 2026-10-30 CVSS score added · GHSA-fm9c-5rcf-2q5p
  7. 2026-10-30 Weakness changed · GHSA-fm9c-5rcf-2q5p
  8. 2026-10-30 6 new references · GHSA-fm9c-5rcf-2q5p
  9. 2026-10-31 Priority changed: MEDIUM → LOW
  10. 2026-11-03 CISA SSVC decision points changed
  11. 2026-11-03 Priority changed: LOW → HIGH
  12. 2026-11-03 Affected versions changed · Red Hat
  13. 2026-11-05 Fix available: Red Hat Trusted Artifact Signer 1.5 · Red Hat
  14. 2026-11-05 Affected versions changed · Red Hat
  15. 2026-11-06 Affected versions changed · Red Hat
  16. 2026-11-06 Fix available: RHSA-2026:95261 · Red Hat
  17. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

Other 5

  • TI-2026-82745 Quadratic CPU consumption in pyasn1 constructed BIT STRING decoding CVSS 3.1HIGH 7.5
  • TI-2026-82744 Quadratic-time denial of service in pyasn1 string and ANY decoding CVSS 3.1HIGH 7.5
  • TI-2026-23747 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVSS 3.1HIGH 7.5
  • TI-2026-18923 pyasn1 has a DoS vulnerability in decoder CVSS 3.1HIGH 7.5
  • TI-2026-42699 pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service CVSS 3.1HIGH 7.5
  • TI-2026-42698 pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences