UBUNTU-CVE-2026-119195: High severity ubuntu/pyasn1 vulnerability
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pyasn1to a version that resolves this vulnerability.Fixed in 0.6.5
Event History
Frequently Asked Questions
What input must an attacker be able to supply to trigger this issue?
An attacker needs to provide highly fragmented ASN.1 data that is decoded by pyasn1. The affected paths include constructed OCTET STRING or character-string values, and indefinite-length ANY values in BER or CER when the decoder uses univ.Any.
Are DER-decoded inputs affected?
DER rejects indefinite lengths, so the indefinite-length ANY path is not reachable through DER. However, DER can accept a definite-length constructed OCTET STRING when asn1Spec selects univ.OctetString, and can accept constructed character strings such as UTF8String without a schema.
What is the practical impact of successful exploitation?
A sufficiently fragmented value causes repeated copying of growing byte sequences, resulting in quadratic decoding work. This can consume CPU and occupy decoding workers, causing a denial of service without confidentiality or integrity impact.
How can I determine whether my deployment is affected?
Deployments using pyasn1 versions earlier than 0.6.5 are affected if they decode attacker-controlled BER, CER, or the specified DER forms. Review ASN.1 decoding entry points for use of univ.OctetString, univ.Any, or schema-less character-string decoding.
What should be done if upgrading is not immediately possible?
Avoid decoding untrusted highly fragmented ASN.1 inputs where possible, particularly BER or CER indefinite-length ANY values and constructed string values. Restricting attacker-controlled input from reaching decoding workers reduces exposure until pyasn1 can be updated to 0.6.5.