CVE-2026-119197 is a vulnerability in the pyasn1 Python library prior to version 0.6.5. It involves inefficient algorithmic complexity in decoding binary REAL values, where the decoding time grows quadratically with the mantissa length. This can cause a denial of service by tying up a CPU core for seconds or longer. The issue is fixed in pyasn1 version 0.6.5.
CVE-2026-119196 is a high-severity vulnerability in the pyasn1 Python library prior to version 0.6.5. It involves inefficient algorithmic complexity during decoding of constructed BIT STRING values, where repeated shifting and copying of accumulated bit values causes quadratic CPU workload. This can lead to CPU exhaustion when processing large fragmented BIT STRING inputs. The issue is fixed in pyasn1 version 0.6.5.
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.
CVE-2026-119194 is a high-severity vulnerability in the pyasn1 Python library affecting versions from 0.3.3 up to but not including 0.6.5. The flaw involves inefficient algorithmic complexity in schemaless container decoding, where attacker-controlled ASN.1 input with many distinct long tag IDs causes hash collisions. This results in quadratic CPU usage during decoding, potentially exhausting CPU resources and reducing service availability. The issue is fixed in version 0.6.5.
A denial of service vulnerability exists in the pyasn1 library's BER/CER/DER decoders and encoders when processing OBJECT IDENTIFIER and RELATIVE-OID values. The vulnerability arises from quadratic time complexity relative to the number of arcs in these values, allowing crafted payloads with many arcs to consume excessive CPU time. This affects applications decoding untrusted ASN.1 data such as certificates, LDAP, SNMP, and Kerberos. The issue is fixed in pyasn1 version 0.6.4, which improves the processing to linear time. Users should upgrade to this version or later to mitigate the risk.
### Impact
The univ.Real type converted its (mantissa, base, exponent) value to a Python float using exact big-integer exponentiation. A BER/CER/DER-encoded REAL value only a few bytes long can carry a very large exponent, causing this computation to attempt to materialize an astronomically large integer.
Any operation that triggers float conversion on such a decoded value — prettyPrint(), str(), comparison, arithmetic, or an explicit float() call — consumes excessive CPU and memory, hanging the process. Applications that decode untrusted ASN.1 data and then print, log, or compare the decoded objects are vulnerable to denial of service. Decoding alone does not trigger the issue.
### Affected components
- pyasn1.type.univ.Real — float conversion (__float__() and everything built on it: prettyPrint(), str(), comparisons, arithmetic, int())
- Reachable through the pyasn1.codec.ber, cer, and der decoders, which produce Real objects from untrusted input; also via directly constructed Real values
The encoders and the native codec are not affected. Applications that never handle ASN.1 REAL values are not affected.
### Patches
Fixed in pyasn1 0.6.4. Binary (base-2) values are now converted with math.ldexp(), and decimal (base-10) values with exponents beyond float range raise OverflowError without constructing huge intermediate integers. Existing behavior is preserved: out-of-range values raise OverflowError and prettyPrint() renders them as <overflow>.
### Workarounds
Avoid converting, printing, or comparing decoded Real objects from untrusted sources; inspect the raw (mantissa, base, exponent) tuple instead.