UBUNTU-CVE-2026-119197: High severity ubuntu/pyasn1 vulnerability
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pyasn1to a version that resolves this vulnerability.Fixed in 0.6.5
Event History
Frequently Asked Questions
What inputs and code paths are required for exploitation?
An attacker must be able to supply ASN.1 data containing a binary-encoded REAL value with a large mantissa to an application that calls pyasn1 BER, CER, or DER decode(). The affected path can be reached whether or not the application uses a schema that explicitly contains REAL.
Are applications using default pyasn1 decoding behavior affected?
Yes. The issue is reachable through BER, CER, or DER decode() without requiring a schema containing REAL, so schema validation alone does not prevent exposure.
What is the impact of a successful attack?
Decoding time grows quadratically with the mantissa length. A comparatively small malicious REAL value can occupy a decoding worker on one CPU core for seconds or longer, causing availability loss.
What should be done to remediate the issue?
Update pyasn1 to version 0.6.5 or later, which fixes the issue. If updating cannot occur immediately, the provided data does not identify a specific mitigation beyond preventing attacker-controlled ASN.1 from reaching the affected decode paths.