CVE-2026-119194: pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding

October 30, 2026

When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container with many distinct long tag IDs can cause quadratic CPU use. Repeated inputs can exhaust CPU and reduce service availability.

References

github.com/advisories/GHSA-fm9c-5rcf-2q5p
github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86
github.com/pyasn1/pyasn1/pull/132
github.com/pyasn1/pyasn1/releases/tag/v0.6.5
github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p
nvd.nist.gov/vuln/detail/CVE-2026-119194

Code Behaviors & Features

Detect and mitigate CVE-2026-119194 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →