CVE-2026-119195
pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 30, 2026
Updated · November 4, 2026
Description
A flaw was found in pyasn1. A remote attacker can cause a Denial of Service (DoS) by providing specially crafted ASN.1 (Abstract Syntax Notation One) encoded data containing numerous fragments. During the decoding of constructed strings or indefinite-length values, the library repeatedly concatenates incoming data chunks, causing quadratic processing overhead. This excessive workload can lead to CPU resource exhaustion, rendering the application unresponsive.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1046 · Creation of Immutable Text Using String Concatenation