# pyasn1 (PyPI) vulnerabilities 9 known vulnerabilities (9 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.6.5 (Oct 27, 2026): no advisory affects it - Newest unaffected release: 0.6.5 (Oct 27, 2026), the latest release - Weekly downloads: 118.2M - Dependents: 22.7K - Releases: 42 since 0.0.13 (Jul 10, 2011) - Registry: https://pypi.org/project/pyasn1/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-119197: 0.0.9a0 to 0.6.4 (0.6.5 is outside it) - CVE-2026-119196: 0.0.9a0 to 0.6.4 (0.6.5 is outside it) - CVE-2026-119195: 0.0.9a0 to 0.6.4 (0.6.5 is outside it) - CVE-2026-119194: 0.3.3 to 0.6.4 (0.6.5 is outside it) - CVE-2026-59884: 0.0.9a0 to 0.6.3 (0.6.4 is outside it) - CVE-2026-59885: 0.0.9a0 to 0.6.3 (0.6.4 is outside it) - CVE-2026-59886: 0.0.9a0 to 0.6.3 (0.6.4 is outside it) - CVE-2026-30922: 0.0.9a0 to 0.6.2 (0.6.3 is outside it) - CVE-2026-23490: 0.6.1 (0.6.2 is outside it) ## Advisories (9) ### [CVE-2026-119197](https://cve.now/CVE-2026-119197): pyasn1: Quadratic-complexity denial of service in binary REAL decoding - Severity: High 7.5 - Published: Oct 29, 2026 - Affected: fixed in 0.6.5. - Fixed in 0.6.5 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 0.6.5, is not affected. ### [CVE-2026-119196](https://cve.now/CVE-2026-119196): pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding - Severity: High 7.5 - Published: Oct 29, 2026 - Affected: fixed in 0.6.5. - Fixed in 0.6.5 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 0.6.5, is not affected. ### [CVE-2026-119195](https://cve.now/CVE-2026-119195): pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding - Severity: High 7.5 - Published: Oct 29, 2026 - Affected: fixed in 0.6.5. - Fixed in 0.6.5 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 0.6.5, is not affected. ### [CVE-2026-119194](https://cve.now/CVE-2026-119194): pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding - Severity: High 7.5 - Published: Oct 29, 2026 - Affected: from 0.3.3, fixed in 0.6.5. - Fixed in 0.6.5 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 0.6.5, is not affected. ### [CVE-2026-59884](https://cve.now/CVE-2026-59884): pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs - Severity: High 7.5 - Published: Jul 14, 2026 - Affected: fixed in 0.6.4. - Fixed in 0.6.4 (released Jul 9, 2026, 5 days before disclosure). - The latest release, 0.6.5, is not affected. ### [CVE-2026-59885](https://cve.now/CVE-2026-59885): pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service - Severity: High 7.5 - Published: Jul 14, 2026 - Affected: fixed in 0.6.4. - Fixed in 0.6.4 (released Jul 9, 2026, 5 days before disclosure). - The latest release, 0.6.5, is not affected. ### [CVE-2026-59886](https://cve.now/CVE-2026-59886): pyasn1: Uncontrolled resource consumption when converting decoded REAL values - Severity: High 7.5 - Published: Jul 14, 2026 - Affected: fixed in 0.6.4. - Fixed in 0.6.4 (released Jul 9, 2026, 5 days before disclosure). - The latest release, 0.6.5, is not affected. ### [CVE-2026-30922](https://cve.now/CVE-2026-30922): pyasn1 Vulnerable to Denial of Service via Unbounded Recursion - Severity: High 7.5 - Published: Mar 18, 2026 - Affected: fixed in 0.6.3. - Fixed in 0.6.3 (released Mar 17, 2026, 1 day before disclosure). - The latest release, 0.6.5, is not affected. ### [CVE-2026-23490](https://cve.now/CVE-2026-23490): pyasn1 has a DoS vulnerability in decoder - Severity: High 7.5 - Published: Jan 16, 2026 - Affected: from 0.6.1, fixed in 0.6.2. - Fixed in 0.6.2 (released Jan 16, 2026, the day of disclosure). - The latest release, 0.6.5, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/pyasn1 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.