Bit String Decoding Vulnerability in pyasn1 Python Library

CVE-2026-119196

What is CVE-2026-119196?

The pyasn1 library, a popular ASN.1 implementation in Python, is susceptible to a performance-related vulnerability affecting its bit string decoding mechanism. Specifically, in versions prior to 0.6.5, the library employs an inefficient decoding strategy that can lead to excessive CPU consumption when handling constructed BIT STRING fragments. Attackers can exploit this by providing specially crafted BER or CER inputs that result in repeated shifts and copies of the accumulated bit values, creating quadratic workloads. This could lead to significant delays or a denial-of-service scenario. The issue was addressed in version 0.6.5, where improvements were made to the decoding process.

References