Pyasn1 (0.3.3 - 0.6.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pyasn1-0.3.3---0.6.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 21:10:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgpyasn1: Denial of service via tag ID collision (CVE-2026-119194)https://feed.craftedsignal.io/briefs/2026-10-pyasn1-dos/Thu, 29 Oct 2026 21:10:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-pyasn1-dos/The pyasn1 library is vulnerable to a denial-of-service attack due to inefficient handling of tag ID collisions during schemaless container decoding, allowing attackers to force quadratic CPU exhaustion.pyasn1 versions 0.3.3 through 0.6.4 contain a vulnerability in the ConstructedPayloadDecoderBase._decodeComponentsSchemaless method. When processing schemaless container decoding for BER, CER, or DER encoded inputs, the library incorrectly stores TagSet information in a growing set. By supplying crafted inputs containing many distinct long tag IDs that cause hash collisions, an attacker can force the library into quadratic CPU work, resulting in denial of service. This issue is resolved in pyasn1 version 0.6.5.

Impact

The vulnerability facilitates a denial-of-service (DoS) condition on applications using the affected pyasn1 library for ASN.1 decoding. This can lead to service availability exhaustion by consuming excessive CPU resources.

Recommendation

  • Upgrade pyasn1 to version 0.6.5 or later to resolve the underlying algorithmic complexity flaw.
  • Audit applications utilizing pyasn1 for processing external, untrusted ASN.1 (BER/CER/DER) data to identify potential exposure points.
  • Implement request timeout and resource limits for services decoding external ASN.1 data to mitigate the impact of CPU-exhaustion attacks.
]]>highadvisory