[pkg-vuln] CVE-2026-119194 in pyasn1@0.6.4 #1420

New Issue

kert · 2026-10-31T04:07:46Z

kert commented

2026-10-31 04:07:46 +00:00

Severity: HIGH
Package: pyasn1 @ 0.6.4
Fixed in: 0.6.5

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quad

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119194

**Severity:** HIGH **Package:** `pyasn1` @ `0.6.4` **Fixed in:** `0.6.5` pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quad **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-119194

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-31 04:07:47 +00:00

kert added the quality ci labels 2026-10-31 04:07:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1420