TI-2026-82745 Aliases CVE-2026-119196 GHSA-2qm8-x737-gmw5

Quadratic CPU consumption in pyasn1 constructed BIT STRING decoding

HIGH 72CWE-407Published 2026-10-29 · Updated 2026-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 fixed, 23 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.

Summary

pyasn1 before 0.6.5 is a generic ASN.1 library for Python. Its constructed BIT STRING decoding repeatedly copies the whole bit value accumulated from earlier fragments, which causes quadratic work (CWE-407). A remote attacker can send crafted BER or CER input with many fragments, without privileges or user interaction, to exhaust CPU during decoding.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00425 37th percentileScored 2026-11-07

Fix Partial pyasn1 (pyasn1): 0.6.5pyasn1 (PyPI): 0.6.5Red Hat: 1 advisoryRed Hat: 1 fixed, 23 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pyasn1	pyasn1	before 0.6.5	0.6.5	Patch available	CNA
—	pyasn1 (PyPI)	before 0.6.5	0.6.5	Patch available	GHSA-2qm8-x737-gmw5

pyasn1 Vendorpyasn1 Affected before 0.6.5 Fixed in 0.6.5 Patch available CNA
pyasn1 (PyPI) Vendor— Affected before 0.6.5 Fixed in 0.6.5 Patch available GHSA-2qm8-x737-gmw5

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:pyasn1:pyasn1::::::::	—	—	pyasn1

cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:*:*:* Versions — — ·pyasn1

Remediation

Upgrade pyasn1 to version 0.6.5 or later. Red Hat fixes Red Hat Trusted Artifact Signer 1.5 in RHSA-2026:95261, released 2026-11-04. Red Hat gives no fix plan for Ansible Automation Orchestrator 2026, Exploit Intelligence, Fence Agents Remediation Operator, Lightspeed Core, Migration Toolkit for Applications 8, and other products.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA pyasn1 (pyasn1) Fixed in 0.6.5
Fix · GHSA-2qm8-x737-gmw5 pyasn1 (PyPI) Fixed in 0.6.5 Advisory →

Red Hat 1 advisory

RHSA-2026:95261 Released 2026-11-04 · Red Hat rating Critical
RHTAS 1.5.1 - Release of Model Transparency 1.0.6
- Red Hat Trusted Artifact Signer 1.5 registry.redhat.io/rhtas/model-transparency-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Ansible Automation Orchestrator 2026	Affected	No fix yet
Exploit Intelligence	Affected	No fix yet
Fence Agents Remediation Operator	Affected	No fix yet
Lightspeed Core	Affected	No fix yet
Migration Toolkit for Applications 8	Affected	No fix yet
Migration Toolkit for Containers	Affected	No fix yet
Migration Toolkit for Virtualization	Affected	No fix yet
OpenShift Lightspeed	Affected	No fix yet
Red Hat AI Inference Server	Affected	No fix yet
Red Hat Ansible Automation Platform 2	Affected	No fix yet
Red Hat Enterprise Linux 10	Affected	No fix yet
Red Hat Enterprise Linux 7	Affected	No fix yet
Red Hat Enterprise Linux 8	Affected	No fix yet
Red Hat Enterprise Linux 9	Affected	No fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet
Red Hat OpenShift Container Platform 4	Affected	No fix yet
Red Hat OpenShift Container Platform 5	Affected	No fix yet
Red Hat OpenStack Platform 16.2	Affected	No fix yet
Red Hat OpenStack Platform 17.1	Affected	No fix yet
Red Hat Quay 3	Affected	No fix yet
Red Hat Satellite 6	Affected	No fix yet
Red Hat Trusted Artifact Signer	Affected	No fix yet
Red Hat Trusted Artifact Signer 1.5	Fixed	RHSA-2026:95261

Not affected: 4 products

OpenShift Service Mesh 3
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat OpenShift AI (RHOAI)
Service Telemetry Framework 1.5

Timeline

2026-10-29 Threatist record created from CVE-2026-119196
2026-10-30 Affected versions changed · Red Hat
2026-10-30 CVSS score added · Red Hat
2026-10-30 Alias added: GHSA-2qm8-x737-gmw5
2026-10-30 Fix available: PyPI/[email protected] · GHSA-2qm8-x737-gmw5
2026-10-30 CVSS score added · GHSA-2qm8-x737-gmw5
2026-10-30 Weakness changed · GHSA-2qm8-x737-gmw5
2026-10-30 6 new references · GHSA-2qm8-x737-gmw5
2026-10-31 Priority changed: MEDIUM → LOW
2026-11-03 Affected versions changed · Red Hat
2026-11-04 CISA SSVC decision points changed
2026-11-04 Priority changed: LOW → HIGH
2026-11-05 Fix available: Red Hat Trusted Artifact Signer 1.5 · Red Hat
2026-11-05 Affected versions changed · Red Hat
2026-11-06 Affected versions changed · Red Hat
2026-11-06 Fix available: RHSA-2026:95261 · Red Hat
2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-119196

Other 5

TI-2026-82744 Quadratic-time denial of service in pyasn1 string and ANY decoding CVSS 3.1HIGH 7.5
TI-2026-82741 Quadratic CPU use in pyasn1 schemaless BER/CER/DER decoding CVSS 3.1HIGH 7.5
TI-2026-23747 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVSS 3.1HIGH 7.5
TI-2026-18923 pyasn1 has a DoS vulnerability in decoder CVSS 3.1HIGH 7.5
TI-2026-42699 pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service CVSS 3.1HIGH 7.5
TI-2026-42698 pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs CVSS 3.1HIGH 7.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences