Inefficient Algorithmic Complexity Affecting pyasn1 package, versions [,0.6.5)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-PYASN1-22113910
- published1 Nov 2026
- disclosed30 Oct 2026
- creditMarkus Magnuson, Daniel Coles,adriank31
Introduced: 30 Oct 2026
NewCVE-2026-119195 (opens in a new tab)How to fix?
Upgrade pyasn1 to version 0.6.5 or higher.
Overview
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the OctetStringPayloadDecoder class and the AnyPayloadDecoder.indefLenValueDecoder method in pyasn1/codec/ber/decoder.py. An attacker can exhaust a decoding worker during a decode() or StreamingDecoder call by supplying a constructed OCTET STRING, an inherited character string such as UTF8String, or an indefinite-length ANY built from many fragments, each of which re-copies the entire value accumulated so far. Valid BER and conforming CER inputs reach the constructed-string loops with or without a schema, while the indefinite-length ANY path additionally requires an asn1Spec selecting univ.Any. DER rejects indefinite lengths and reaches the constructed OCTET STRING path only through a schema selecting univ.OctetString, though it accepts a constructed UTF8String even without one.
Workaround
This vulnerability can be avoided by enforcing application-appropriate size limits on untrusted ASN.1 input before passing it to the decoder and capping the CPU available to decoding workers, and applications requiring DER can reject constructed string encodings before invoking the decoder.