Bug 2563664 (CVE-2026-119194)

Summary:	CVE-2026-119194 pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, alinfoot, anpicker, anthomas, aos-team-art-private, aprice, asdas, bbrownin, blitton, cmyers, dfreiber, dnakabaa, doconnor, dpaolell, drow, dschmidt, dtrifiro, dymurray, eborisov, ebourniv, eglynn, ehelms, ggainey, gparvin, hasun, ibolton, ilpinto, jbalunas, jburrell, jdelft, jdobes, jfula, jjoyce, jlanda, jmatthew, jmitchel, jmontleo, jowilson, jpasqual, jpretori, jsamir, jschluet, jupierce, juwatts, jwong, kaycoth, kbempah, kgaikwad, kshier, lball, lblicha, lcouzens, lgarciaa, lhh, ltomasbo, mbarnett, mbiarnes, mburns, mdellweg, mgarciac, mhayden, mhulan, mrunge, mwoodson, ngough, nmoumoul, nyancey, oezr, ogajduse, omaciel, ometelka, orabin, osousa, pakotvan, pcreech, pgaikwad, ppalepu, ppostler, prdhamdh, prwatson, ptisnovs, rbobbitt, rchan, rhaigner, rhel-process-autobot, rjohnson, sbunciak, sdoran, sghai, sidsharm, simaishi, slucidi, smallamp, solenoci, sseago, stcannon, sthirugn, suppawar, syedriko, tguha, tmalecek, tsze, veshanka, vimartin, vkumar, vlaad, watson-tool-maintainers, weaton, xdharmai, yguenane, ykashtan, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in pyasn1. A remote attacker could trigger a Denial of Service (DoS) by sending specially crafted Abstract Syntax Notation One (ASN.1) data containing colliding tag identifiers during schemaless decoding. Processing these inputs causes inefficient container lookups that consume excessive CPU resources, leading to service degradation or unresponsiveness.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 20:04:48 UTC

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.