pyasn1 CVE-2026-119195

The affected application must pass attacker-controlled ASN.1 into pyasn1's decode() or StreamingDecoder path without enforcing input-size or decoder CPU limits. Concrete trigger paths differ by codec: BER and conforming CER accept constructed OCTET STRING and inherited character strings (UTF8String, PrintableString, IA5String, BMPString, GeneralizedTime, etc.) directly; the indefinite-length ANY path is reached in BER/CER only when an asn1Spec selects univ.Any; the DER decoder reaches the loop only via der.decode(data, asn1Spec=univ.OctetString()) for a definite-length constructed OCTET STRING, or via a constructed character string decoded without a schema, while DER rejects schemaless constructed OCTET STRING and all indefinite lengths. Limiting factors: effective abuse needs megabyte-scale, highly fragmented input and the absence of application-level size/CPU caps; no privileges, authentication, or user interaction are required, but the vendor states that whether the decoder is reachable pre-authentication or through a particular protocol is application-specific and not established by the library finding.

The input CVSS of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is an explicitly library-level, availability-only score that the GHSA advisory says assumes 'a reasonable application that automatically decodes attacker-supplied ASN.1 from unauthenticated network input.' The vector signals remote, low-complexity, unauthenticated reach with no confidentiality or integrity impact - consistent with a CWE-407 quadratic-time DoS. Decision signals are mixed and partly absent: the vuln.today priority is 'this_week' (prompt patching, not emergency/act_now); no CISA KEV entry is present in the input, so there is no confirmed active exploitation; and no EPSS score was supplied, so exploitation probability cannot be weighed. A public reproduction script is published in the GHSA advisory, but a reproducer is not the same as confirmed in-the-wild use. Net assessment: this is a genuine but deployment-gated availability risk rather than a drop-everything event - the raw 7.5 overstates real risk for the many adopters that do not expose a pyasn1 decoder to untrusted, size-unbounded ASN.1, and understates it for services (SNMP, LDAP, certificate/X.509 or other ASN.1 parsers) that do. The vendor itself cautions that whether the flaw is reachable pre-authentication or via a given protocol depends on the application, so prioritize by whether your deployment decodes attacker-controlled ASN.1.

An unauthenticated attacker submits a megabyte-scale ASN.1 message built from many small constructed OCTET STRING or character-string fragments (or an indefinite-length ANY) to a service that decodes it with pyasn1 ≤ 0.6.4; the growing-bytes reassembly performs O(N²) copying and ties up a decoding worker for seconds per message. Repeated submissions exhaust available decoder workers and CPU, denying service while the attack continues. A working proof-of-concept reproducer is published in the GHSA advisory, though it is not verified as a weaponized exploit against a specific product.