Performance Degradation in pyasn1 Library for Python Affecting Multiple Users

CVE-2026-119195

What is CVE-2026-119195?

The pyasn1 library in Python prior to version 0.6.5 features a performance concern related to how it handles constructed STRING and indefinite-length ANY decoding. An attacker can exploit this by sending specially crafted BER or CER data, which leads to repeated concatenation of data fragments, consuming CPU resources significantly. The library's current handling mechanism can cause a quadratic work situation, where a sufficiently fragmented input overwhelms the decoding workers, thus causing CPU exhaustion. This vulnerability does not affect the confidentiality or integrity of the data but poses a serious risk to system performance.

References