pyasn1 CVE-2026-119194

The application must decode attacker-controlled BER, CER, or DER bytes in SCHEMALESS mode - i.e. calling pyasn1's decoder without supplying an asn1Spec, which routes through ConstructedPayloadDecoderBase._decodeComponentsSchemaless (present in v0.6.4 and inherited by the CER and DER decoders). The malicious input is a constructed container holding many distinct long-form tag IDs whose TagSet hashes collide, so each insertion compares against a growing set of prior tags. Limiting factors: schema-based decoding (with an explicit asn1Spec) is not on this path and is unaffected; the attacker must be able to supply the raw encoded bytes; and impact is confined to CPU/availability - decoded values and order remain correct, so no data corruption or disclosure results.

This is a genuine but bounded availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is credible for a network-reachable, unauthenticated algorithmic-complexity DoS (CWE-407), and all impact is on availability only - the GHSA advisory explicitly states no confidentiality or integrity impact was observed, which contradicts the input 'Information Disclosure' tag. The vuln.today Decision label is 'this_week' (not act_now/emergency), consistent with a DoS rather than RCE. No CISA KEV listing and no EPSS score are provided in the input, so there is no signal of active or widespread exploitation; however, the GHSA advisory ships a complete, working proof-of-concept demonstrating ~4x CPU growth when component count doubles (0.438s→1.747s at 3,200→6,400 colliding components on CPython 3.12.10), so exploitability is well established in principle. The real-world priority is tempered by a key precondition the CVSS vector does not capture: exploitation only affects applications performing SCHEMALESS decoding of attacker-controlled input - AV:N/AC:L/PR:N describes severity under that condition but not the deployment prevalence of that code path. Net: patch promptly in services that decode untrusted ASN.1 without a schema, but this is a resource-exhaustion bug, not memory corruption or data exposure.

An attacker sends a single small but crafted BER/CER/DER message to a network service that decodes it with pyasn1 in schemaless mode (e.g. decoder.decode() with no asn1Spec). The payload packs many distinct long-form tag IDs chosen so their TagSet hashes collide, forcing quadratic comparison work during decode and spiking CPU. A working proof-of-concept is published in the GHSA-fm9c-5rcf-2q5p advisory, and repeated such requests can exhaust CPU and degrade or deny service.