pyasn1: Denial of service via tag ID collision (CVE-2026-119194)
The pyasn1 library is vulnerable to a denial-of-service attack due to inefficient handling of tag ID collisions during schemaless container decoding, allowing attackers to force quadratic CPU exhaustion.
CVE search metadata
CVE search record: CVE-2026-119194. Severity: high. CVSS: 7.5. KEV: no. Product: pyasn1 (0.3.3 - 0.6.4), pyasn1 (< 0.6.5). Brief: pyasn1: Denial of service via tag ID collision (CVE-2026-119194). Brief link: https://feed.craftedsignal.io/briefs/2026-10-pyasn1-dos/
CVE search record: CVE-2026-119196. KEV: no. Product: pyasn1 (0.3.3 - 0.6.4), pyasn1 (< 0.6.5). Brief: pyasn1: Denial of service via tag ID collision (CVE-2026-119194). Brief link: https://feed.craftedsignal.io/briefs/2026-10-pyasn1-dos/
Triage facts
Revision 1- Applicability
- pyasn1 (0.3.3 - 0.6.4), pyasn1 (< 0.6.5)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 29, 21:10 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
What's new
- 1. added coverage for pyasn1 (< 0.6.5) Oct 29, 21:11 via nvd
pyasn1 versions 0.3.3 through 0.6.4 contain a vulnerability in the ConstructedPayloadDecoderBase._decodeComponentsSchemaless method. When processing schemaless container decoding for BER, CER, or DER encoded inputs, the library incorrectly stores TagSet information in a growing set. By supplying crafted inputs containing many distinct long tag IDs that cause hash collisions, an attacker can force the library into quadratic CPU work, resulting in denial of service. This issue is resolved in pyasn1 version 0.6.5.
Impact
The vulnerability facilitates a denial-of-service (DoS) condition on applications using the affected pyasn1 library for ASN.1 decoding. This can lead to service availability exhaustion by consuming excessive CPU resources.
Recommendation
- Upgrade pyasn1 to version 0.6.5 or later to resolve the underlying algorithmic complexity flaw.
- Audit applications utilizing pyasn1 for processing external, untrusted ASN.1 (BER/CER/DER) data to identify potential exposure points.
- Implement request timeout and resource limits for services decoding external ASN.1 data to mitigate the impact of CPU-exhaustion attacks.
Immediate actions
Upgrade all instances of pyasn1 to version 0.6.5 or later
Upgrade pyasn1 to 0.6.5 or later in all dependencies
Threat Hunt
Monitor application services for sustained high CPU utilization spikes originating from ASN.1 decoding routines
Data: Application performance monitoring (APM) logs, CPU usage metrics per process/container
Identify applications utilizing pyasn1 for ASN.1 parsing
Data: Software Bill of Materials (SBOM), Dependency manifests (requirements.txt, Pipfile.lock)
Mitigations
Upgrade pyasn1 to 0.6.5
CVE-2026-119194