CVE-2026-119197 pyasn1: Quadratic-complexity denial of service in binary REAL decoding
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119197?
CVE-2026-119197 is a high-severity vulnerability in pyasn1, published on 29 Oct 2026.
Official description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.
Weakness: CWE-407
Which versions are affected by CVE-2026-119197?
How do I fix CVE-2026-119197?
No fix has been published for CVE-2026-119197 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119197 being exploited?
There is no known exploitation of CVE-2026-119197 in the wild and no public exploit code.