[pkg-vuln] CVE-2026-119196 in pyasn1@0.6.4 #1422

New Issue

kert · 2026-10-31T04:07:47Z

kert commented

2026-10-31 04:07:47 +00:00

Severity: HIGH
Package: pyasn1 @ 0.6.4
Fixed in: 0.6.5

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119196

**Severity:** HIGH **Package:** `pyasn1` @ `0.6.4` **Fixed in:** `0.6.5` pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-119196

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-31 04:07:47 +00:00

kert added the ci quality labels 2026-10-31 04:07:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1422