UBUNTU-CVE-2026-119196: High severity ubuntu/pyasn1 vulnerability
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pyasn1to a version that resolves this vulnerability.Fixed in 0.6.5
Event History
Frequently Asked Questions
What input and access does an attacker need to trigger the issue?
An attacker needs to supply BER or CER data containing many constructed BIT STRING fragments to a pyasn1 decode() operation. No authentication or user interaction is required according to the provided severity vector.
Are DER decoders affected as well?
Schema-driven DER decoding can also be affected because it accepts a definite-length constructed BIT STRING. The issue occurs during decoding and does not require later conversion or formatting of the decoded value.
What is the operational impact?
Large, highly fragmented BIT STRING values can cause quadratic CPU work during decode(), potentially exhausting CPU and causing a denial of service. The provided vector indicates availability impact only, with no stated confidentiality or integrity impact.
What version resolves the issue?
The issue is fixed in pyasn1 version 0.6.5. Versions prior to 0.6.5 are affected.