[pkg-vuln] CVE-2026-119195 in pyasn1@0.6.4 #1421

New Issue

kert · 2026-10-31T04:07:47Z

kert commented

2026-10-31 04:07:47 +00:00

Severity: HIGH
Package: pyasn1 @ 0.6.4
Fixed in: 0.6.5

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119195

**Severity:** HIGH **Package:** `pyasn1` @ `0.6.4` **Fixed in:** `0.6.5` pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-119195

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-31 04:07:47 +00:00

kert added the ci quality labels 2026-10-31 04:07:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1421