[pkg-vuln] CVE-2026-119197 in pyasn1@0.6.4 #1423

New Issue

kert · 2026-10-31T04:07:47Z

kert commented

2026-10-31 04:07:47 +00:00

Severity: HIGH
Package: pyasn1 @ 0.6.4
Fixed in: 0.6.5

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119197

**Severity:** HIGH **Package:** `pyasn1` @ `0.6.4` **Fixed in:** `0.6.5` pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-119197

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-31 04:07:47 +00:00

kert added the ci quality labels 2026-10-31 04:07:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1423