CVE-2026-119194

A flaw was found in pyasn1. A remote attacker could trigger a Denial of Service (DoS) by sending specially crafted Abstract Syntax Notation One (ASN.1) data containing colliding tag identifiers during schemaless decoding. Processing these inputs causes inefficient container lookups that consume excessive CPU resources, leading to service degradation or unresponsiveness.

This vulnerability is rated as an Important impact because unauthenticated remote attackers can cause complete availability loss through CPU exhaustion against services processing untrusted ASN.1 data. The risk manifests when applications decode BER, CER, or DER structures without an explicit schema, allowing crafted colliding tag identifiers to induce quadratic computational overhead. Deployments where pyasn1 operations validate inputs against predefined schemas or operate exclusively on trusted internal data remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.