Hi,
The following vulnerabilities were published for pyasn1.
CVE-2026-119194[0]:
| pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until
| 0.6.5, schemaless container decoding stores every decoded
| component's TagSet in a growing set even though only one-versus-
| multiple tag types must be distinguished. Attacker-controlled BER,
| CER, or DER input contains many distinct long tag IDs whose TagSet
| hashes collide. Each later set insertion compares against an
| increasing number of earlier colliding tags in
| ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing
| quadratic CPU work while decoded values and order remain valid.
| Repeated inputs can exhaust decoder CPU and reduce service
| availability. This issue is fixed in version 0.6.5.
CVE-2026-119195[1]:
| pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5,
| constructed string and indefinite-length ANY decoding repeatedly
| concatenates each fragment onto a growing bytes value. Attacker-
| controlled BER or CER data can use many constructed OCTET STRING or
| character-string fragments. DER rejects constructed OCTET STRING
| without a schema, but accepts its definite-length form when asn1Spec
| selects univ.OctetString; it also accepts constructed character
| strings such as UTF8String without a schema, even though those
| encodings are not valid DER. The separate indefinite-length ANY path
| is reachable in BER and CER when asn1Spec selects univ.Any; DER
| rejects indefinite lengths. OctetStringPayloadDecoder uses growing
| header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses
| growing chunk concatenation, repeatedly copying an increasing prefix
| and causing quadratic work. A sufficiently fragmented value can
| occupy decoding workers and cause CPU exhaustion without
| confidentiality or integrity impact. This issue is fixed in version
| 0.6.5.
CVE-2026-119196[2]:
| pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5,
| constructed BIT STRING decoding repeatedly shifts and copies the
| complete bit value accumulated from earlier fragments. Attacker-
| controlled BER or CER input contains many constructed BIT STRING
| fragments; schema-driven DER also accepts a definite-length
| constructed BIT STRING. BitStringPayloadDecoder repeatedly calls
| BitString.fromOctetString with the prior bitString as prepend,
| shifting an ever-growing SizedInteger for each fragment and causing
| quadratic work. Large fragmented values can exhaust CPU during
| decode() without requiring later conversion or formatting. This
| issue is fixed in version 0.6.5.
CVE-2026-119197[3]:
| pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary
| REAL decoding builds a large mantissa one octet at a time by
| shifting a growing integer and slicing the remaining byte string.
| Attacker-controlled ASN.1 includes a binary-encoded REAL with a
| large mantissa and reaches BER, CER, or DER decode(), with or
| without a schema containing REAL. RealPayloadDecoder.valueDecoder
| repeatedly performs a left shift, OR, and suffix copy for every
| mantissa octet, making decode time quadratic in mantissa length. A
| comparatively small REAL value can hold a decoding worker on one CPU
| core for seconds or longer and cause availability loss. This issue
| is fixed in version 0.6.5.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-119194
https://www.cve.org/CVERecord?id=CVE-2026-119194
[1] https://security-tracker.debian.org/tracker/CVE-2026-119195
https://www.cve.org/CVERecord?id=CVE-2026-119195
[2] https://security-tracker.debian.org/tracker/CVE-2026-119196
https://www.cve.org/CVERecord?id=CVE-2026-119196
[3] https://security-tracker.debian.org/tracker/CVE-2026-119197
https://www.cve.org/CVERecord?id=CVE-2026-119197
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore