Bug 2563663 (CVE-2026-119195)

Summary:	CVE-2026-119195 pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, alinfoot, anpicker, anthomas, aos-team-art-private, aprice, asdas, bbrownin, blitton, cmyers, dfreiber, dnakabaa, doconnor, dpaolell, drow, dschmidt, dtrifiro, dymurray, eborisov, ebourniv, eglynn, ehelms, ggainey, gparvin, hasun, ibolton, ilpinto, jbalunas, jburrell, jdelft, jdobes, jfula, jjoyce, jlanda, jmatthew, jmitchel, jmontleo, jowilson, jpasqual, jpretori, jsamir, jschluet, jupierce, juwatts, jwong, kaycoth, kbempah, kgaikwad, kshier, lball, lblicha, lcouzens, lgarciaa, lhh, ltomasbo, mbarnett, mbiarnes, mburns, mdellweg, mgarciac, mhayden, mhulan, mrunge, mwoodson, ngough, nmoumoul, nyancey, oezr, ogajduse, omaciel, ometelka, orabin, osousa, pakotvan, pcreech, pgaikwad, ppalepu, ppostler, prdhamdh, prwatson, ptisnovs, rbobbitt, rchan, rhaigner, rhel-process-autobot, rjohnson, sbunciak, sdoran, sghai, sidsharm, simaishi, slucidi, smallamp, solenoci, sseago, stcannon, sthirugn, suppawar, syedriko, tguha, tmalecek, tsze, veshanka, vimartin, vkumar, vlaad, watson-tool-maintainers, weaton, xdharmai, yguenane, ykashtan, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in pyasn1. A remote attacker can cause a Denial of Service (DoS) by providing specially crafted ASN.1 (Abstract Syntax Notation One) encoded data containing numerous fragments. During the decoding of constructed strings or indefinite-length values, the library repeatedly concatenates incoming data chunks, causing quadratic processing overhead. This excessive workload can lead to CPU resource exhaustion, rendering the application unresponsive.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 20:00:14 UTC

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.