CVE-2026-119194

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.

• CWE-407

• https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86
• https://github.com/pyasn1/pyasn1/pull/132
• https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5
• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p

Published

Oct 29, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119187Forge (also called node-forge) is a native implementation of…7.5
• CVE-2026-119188Forge (also called node-forge) is a native implementation of…7.5
• CVE-2026-119189Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-119190Forge (also called node-forge) is a native implementation of…7.4
• CVE-2026-119191Forge (also called node-forge) is a native implementation of…7.5
• CVE-2026-119193PHPUnit is a testing framework for PHP. From 13.4.0 until 13…5.4
• CVE-2026-119195pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5…7.5
• CVE-2026-119196pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5…7.5
• CVE-2026-119197pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5…7.5
• CVE-2026-119198Nuxt is an open-source web development framework for Vue.js.…5.9
• CVE-2026-119199Nuxt is an open-source web development framework for Vue.js.…5.9
• CVE-2026-1192A vulnerability was determined in Tosei Online Store Managem…7.3