Quadratic-complexity denial of service in pyasn1 binary REAL decoding
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 23 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.
Summary
pyasn1 versions before 0.6.5 are affected. The library decodes binary REAL values by building the mantissa one octet at a time, so decode time grows quadratically with the mantissa length (CWE-407). A remote, unauthenticated attacker who can supply ASN.1 data to BER, CER or DER decoding can send a REAL with a large mantissa, holding a CPU core for seconds or longer and causing availability loss.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pyasn1 | pyasn1 | before 0.6.5 | 0.6.5 | Patch available | CNA |
| — | pyasn1 (PyPI) | before 0.6.5 | 0.6.5 | Patch available | GHSA-mm57-4v3p-rchx |
- pyasn1 Vendorpyasn1 Affected before 0.6.5 Fixed in 0.6.5 Patch available CNA
- pyasn1 (PyPI) Vendor— Affected before 0.6.5 Fixed in 0.6.5 Patch available GHSA-mm57-4v3p-rchx
Remediation
Upgrade the pyasn1 PyPI package to version 0.6.5, which fixes the issue. The sources list no fixed version for Ansible Automation Orchestrator 2026, Exploit Intelligence, Fence Agents Remediation Operator, Lightspeed Core, Migration Toolkit for Applications 8 and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA pyasn1 (pyasn1) Fixed in 0.6.5
- Fix · GHSA-mm57-4v3p-rchx pyasn1 (PyPI) Fixed in 0.6.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | No fix yet |
| Exploit Intelligence | Affected | No fix yet |
| Fence Agents Remediation Operator | Affected | No fix yet |
| Lightspeed Core | Affected | No fix yet |
| Migration Toolkit for Applications 8 | Affected | No fix yet |
| Migration Toolkit for Containers | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
Not affected: 4 products
- OpenShift Service Mesh 3
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift AI (RHOAI)
- Service Telemetry Framework 1.5
Timeline
- 2026-10-29 Threatist record created from CVE-2026-119197
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: MEDIUM → LOW
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 CVSS score added · Red Hat
- 2026-10-30 Alias added: GHSA-mm57-4v3p-rchx
- 2026-10-30 Fix available: PyPI/[email protected] · GHSA-mm57-4v3p-rchx
- 2026-10-30 CVSS score added · GHSA-mm57-4v3p-rchx
- 2026-10-30 Weakness changed · GHSA-mm57-4v3p-rchx
- 2026-10-30 6 new references · GHSA-mm57-4v3p-rchx
- 2026-10-31 Affected versions changed · Red Hat
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-05 Affected versions changed · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
More pyasn1 vulnerabilities
- TI-2026-82745 Quadratic CPU consumption in pyasn1 constructed BIT STRING decoding CVSS 3.1HIGH 7.5
- TI-2026-82744 Quadratic-time denial of service in pyasn1 string and ANY decoding CVSS 3.1HIGH 7.5
- TI-2026-82741 Quadratic CPU use in pyasn1 schemaless BER/CER/DER decoding CVSS 3.1HIGH 7.5
- TI-2026-23747 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVSS 3.1HIGH 7.5
- TI-2026-18923 pyasn1 has a DoS vulnerability in decoder CVSS 3.1HIGH 7.5
- TI-2026-42699 pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service CVSS 3.1HIGH 7.5
Sources
- CVE-2026-119197 · CVE Program
- CVE-2026-119197 · NVD
- FIRST EPSS
- GHSA-mm57-4v3p-rchx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-119197 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences