Inefficient Binary REAL Decoding in pyasn1 Library for Python

CVE-2026-119197

What is CVE-2026-119197?

The pyasn1 library for Python is susceptible to a denial of service vulnerability due to inefficient binary REAL decoding. Prior to version 0.6.5, an attacker could exploit this library by supplying a specially crafted ASN.1 structure containing a large mantissa in a binary-encoded REAL value. The decoding process, executed by the RealPayloadDecoder, involves repeated left shifting and manipulation, leading to quadratic time complexity correlating with the mantissa length. This can result in significant delays, tying up CPU resources and causing availability issues for applications relying on the affected library. Users are advised to upgrade to version 0.6.5 or later to mitigate this vulnerability.

References