{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apyasn1_projectpyasn1python/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pyasn1_project:pyasn1:*:*:*:*:*:python:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-119194"},{"id":"CVE-2026-119196"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pyasn1 (0.3.3 - 0.6.4)","pyasn1 (\u003c 0.6.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["pyasn1"],"content_html":"\u003cp\u003epyasn1 versions 0.3.3 through 0.6.4 contain a vulnerability in the \u003ccode\u003eConstructedPayloadDecoderBase._decodeComponentsSchemaless\u003c/code\u003e method. When processing schemaless container decoding for BER, CER, or DER encoded inputs, the library incorrectly stores TagSet information in a growing set. By supplying crafted inputs containing many distinct long tag IDs that cause hash collisions, an attacker can force the library into quadratic CPU work, resulting in denial of service. This issue is resolved in pyasn1 version 0.6.5.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability facilitates a denial-of-service (DoS) condition on applications using the affected pyasn1 library for ASN.1 decoding. This can lead to service availability exhaustion by consuming excessive CPU resources.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade pyasn1 to version 0.6.5 or later to resolve the underlying algorithmic complexity flaw.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing pyasn1 for processing external, untrusted ASN.1 (BER/CER/DER) data to identify potential exposure points.\u003c/li\u003e\n\u003cli\u003eImplement request timeout and resource limits for services decoding external ASN.1 data to mitigate the impact of CPU-exhaustion attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T21:11:00Z","date_published":"2026-10-29T21:10:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pyasn1-dos/","summary":"The pyasn1 library is vulnerable to a denial-of-service attack due to inefficient handling of tag ID collisions during schemaless container decoding, allowing attackers to force quadratic CPU exhaustion.","title":"pyasn1: Denial of service via tag ID collision (CVE-2026-119194)","url":"https://feed.craftedsignal.io/briefs/2026-10-pyasn1-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:pyasn1_project:pyasn1:*:*:*:*:*:python:*:*","version":"https://jsonfeed.org/version/1.1"}