CVE-2026-119197

A flaw was found in pyasn1. A remote attacker can exploit this vulnerability by submitting specially crafted Abstract Syntax Notation One (ASN.1) data containing a binary-encoded floating-point (REAL) value with a large mantissa. Processing this input leads to quadratic decoding time and excessive CPU consumption, resulting in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to eliminate iterative per-octet bit-shifting and byte slicing in pyasn1 binary REAL mantissa decoding in favor of linear-time integer conversion: upgrade to pyasn1 0.6.5 (or the corresponding fixed Red Hat builds), which replace the iterative per-octet shifting, bitwise OR, and byte slicing loop with a single linear-time int.from_bytes call, closing crafted ASN.1 payload containing binary-encoded REAL with a large mantissa. Until patched, this is a concern on Applications parsing untrusted ASN.1 input with pyasn1 BER, CER, or DER decoding, so Reject or strictly enforce size limits on untrusted ASN.1 inputs that may contain REAL values. As a compensating measure, Enforce RLIMIT_CPU limits on decoding processes using ulimit or prlimit to terminate workers trapped in quadratic bit-shifting and slicing loops, Impose parsing timeouts or computational limits on decoding operations to bound worker hang time from quadratic mantissa processing, and Throttle client request volume and connections to impede sustained CPU starvation across worker threads. These controls limit blast radius and contain exploitation, but they do not fix the underlying quadratic complexity defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)