Read the docs
TI-2026-82744 Aliases CVE-2026-119195GHSA-9m75-vc3g-4x39

Quadratic-time denial of service in pyasn1 string and ANY decoding

Priority HIGH 72CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 23 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.

Summary

The pyasn1 Python library is affected before 0.6.5. Constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value, which causes quadratic-time work (CWE-407). A remote unauthenticated attacker can send BER or CER data with many fragments to exhaust CPU on decoding workers, with no confidentiality or integrity impact.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00527 44th percentileScored 2026-11-07
Fix Partial pyasn1 (pyasn1): 0.6.5pyasn1 (PyPI): 0.6.5Red Hat: 1 advisoryRed Hat: 1 fixed, 23 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pyasn1pyasn1before 0.6.50.6.5Patch availableCNA
—pyasn1 (PyPI)before 0.6.50.6.5Patch availableGHSA-9m75-vc3g-4x39
  • pyasn1 Vendorpyasn1 Affected before 0.6.5 Fixed in 0.6.5 Patch available CNA
  • pyasn1 (PyPI) Vendor— Affected before 0.6.5 Fixed in 0.6.5 Patch available GHSA-9m75-vc3g-4x39

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:*:*:*——pyasn1
  • cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:*:*:* Versions — — ·pyasn1

Remediation

Upgrade pyasn1 to version 0.6.5. Red Hat fixes this in Red Hat Trusted Artifact Signer 1.5 through RHSA-2026:95261. Red Hat reports no fix available for Ansible Automation Orchestrator 2026, Exploit Intelligence, Fence Agents Remediation Operator, Lightspeed Core, Migration Toolkit for Applications 8 and other products.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA pyasn1 (pyasn1) Fixed in 0.6.5
  • Fix · GHSA-9m75-vc3g-4x39 pyasn1 (PyPI) Fixed in 0.6.5 Advisory →

Red Hat 1 advisory

  • RHSA-2026:95261 Released 2026-11-04 · Red Hat rating Critical
    RHTAS 1.5.1 - Release of Model Transparency 1.0.6
    • Red Hat Trusted Artifact Signer 1.5 registry.redhat.io/rhtas/model-transparency-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Ansible Automation Orchestrator 2026AffectedNo fix yet
Exploit IntelligenceAffectedNo fix yet
Fence Agents Remediation OperatorAffectedNo fix yet
Lightspeed CoreAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
Migration Toolkit for ContainersAffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat OpenStack Platform 17.1AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat Trusted Artifact Signer 1.5Fixed RHSA-2026:95261
Not affected: 4 products
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift AI (RHOAI)
  • Service Telemetry Framework 1.5

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-119195
  2. 2026-10-29 CISA SSVC decision points changed
  3. 2026-10-29 Priority changed: MEDIUM → HIGH
  4. 2026-10-30 Affected versions changed · Red Hat
  5. 2026-10-30 CVSS score added · Red Hat
  6. 2026-10-30 Alias added: GHSA-9m75-vc3g-4x39
  7. 2026-10-30 Fix available: PyPI/[email protected] · GHSA-9m75-vc3g-4x39
  8. 2026-10-30 CVSS score added · GHSA-9m75-vc3g-4x39
  9. 2026-10-30 Weakness changed · GHSA-9m75-vc3g-4x39
  10. 2026-10-30 6 new references · GHSA-9m75-vc3g-4x39
  11. 2026-11-03 Affected versions changed · Red Hat
  12. 2026-11-05 Fix available: Red Hat Trusted Artifact Signer 1.5 · Red Hat
  13. 2026-11-05 Affected versions changed · Red Hat
  14. 2026-11-06 Fix available: RHSA-2026:95261 · Red Hat
  15. 2026-11-06 Affected versions changed · Red Hat
  16. 2026-11-07 Affected versions changed · Red Hat

References

Advisory 1

Other 5

  • TI-2026-82745 Quadratic CPU consumption in pyasn1 constructed BIT STRING decoding CVSS 3.1HIGH 7.5
  • TI-2026-82741 Quadratic CPU use in pyasn1 schemaless BER/CER/DER decoding CVSS 3.1HIGH 7.5
  • TI-2026-23747 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVSS 3.1HIGH 7.5
  • TI-2026-18923 pyasn1 has a DoS vulnerability in decoder CVSS 3.1HIGH 7.5
  • TI-2026-42699 pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service CVSS 3.1HIGH 7.5
  • TI-2026-42698 pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences