CVE-2026-119194
Publication date 29 October 2026
Last updated 11 November 2026
Ubuntu priority
Description
pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| pyasn1 | 26.10 stonking |
Fixed in 0.6.4-1ubuntu0.1
|
| 26.04 LTS resolute |
Fixed in 0.6.3-1ubuntu0.2
|
|
| 24.04 LTS noble |
Fixed in 0.4.8-4ubuntu0.4
|
|
| 22.04 LTS jammy |
Fixed in 0.4.8-1ubuntu0.4
|
|
| 20.04 LTS focal |
Fixed in 0.4.2-3ubuntu0.20.04.1~esm2
|
|
| 18.04 LTS bionic |
Fixed in 0.4.2-3ubuntu0.18.04.1~esm2
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
7.5 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-9011-1
- pyasn1 vulnerabilities
- 9 November 2026