Bug 2563666 (CVE-2026-119196)

Summary: CVE-2026-119196 pyasn1: pyasn1: Denial of Service via constructed bit string decoding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, alinfoot, anpicker, anthomas, aos-team-art-private, aprice, asdas, bbrownin, blitton, cmyers, dfreiber, dnakabaa, doconnor, dpaolell, drow, dschmidt, dtrifiro, dymurray, eborisov, ebourniv, eglynn, ehelms, ggainey, gparvin, hasun, ibolton, ilpinto, jbalunas, jburrell, jdelft, jdobes, jfula, jjoyce, jlanda, jmatthew, jmitchel, jmontleo, jowilson, jpasqual, jpretori, jsamir, jschluet, jupierce, juwatts, jwong, kaycoth, kbempah, kgaikwad, kshier, lball, lblicha, lcouzens, lgarciaa, lhh, ltomasbo, mbarnett, mbiarnes, mburns, mdellweg, mgarciac, mhayden, mhulan, mrunge, mwoodson, ngough, nmoumoul, nyancey, oezr, ogajduse, omaciel, ometelka, orabin, osousa, pakotvan, pcreech, pgaikwad, ppalepu, ppostler, prdhamdh, prwatson, ptisnovs, rbobbitt, rchan, rhaigner, rhel-process-autobot, rjohnson, sbunciak, sdoran, sghai, sidsharm, simaishi, slucidi, smallamp, solenoci, sseago, stcannon, sthirugn, suppawar, syedriko, tguha, tmalecek, tsze, veshanka, vimartin, vkumar, vlaad, watson-tool-maintainers, weaton, xdharmai, yguenane, ykashtan, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in pyasn1. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted Abstract Syntax Notation One (ASN.1) data containing multiple constructed bit string fragments. When decoding these fragments, the library repeatedly copies and shifts accumulated bit data, leading to quadratic processing time and excessive CPU consumption.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 20:13:42 UTC 
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.