apache-superset

A high-severity security vulnerability (CVE-2026-119195) affects the apache-superset package versions prior to 6.1.0-r8. The issue involves the pyasn1 component, which is a generic ASN. The vulnerability has no impact on confidentiality or integrity but results in a high impact on availability. A fix is available in version 6.1.0-r8.

Apache superset: pyasn1 is a generic ASN (CVE-2026-119195)

smbclient-ng

A denial of service vulnerability exists in pyasn1 versions 0.6.4 and earlier used by smbclient-ng (>=3.1.0). The flaw causes quadratic-time CPU consumption when decoding constructed OCTET STRINGs or indefinite-length ANY types composed of many fragments, leading to CPU exhaustion. This affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. The CVSS v3.1 base score is 7.5 (high severity).

Smbclient ng: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

scoutsuite

A denial of service vulnerability exists in pyasn1 version 0.6.4 and earlier due to quadratic-time complexity in decoding constructed OCTET STRINGs, certain constructed character strings, and indefinite-length ANY types. This can cause excessive CPU consumption when processing attacker-controlled ASN.1 inputs with many fragments. The issue affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5 (high severity).

Scoutsuite: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

kimi-cli

A denial of service vulnerability exists in pyasn1 version 0.6.4 and earlier, affecting the decoding of constructed OCTET STRINGs and indefinite-length ANY types. The decoder's string reassembly process exhibits quadratic time complexity due to repeated copying of accumulated fragments, leading to excessive CPU consumption. This can be exploited by an attacker supplying crafted ASN.1 input to cause CPU exhaustion. The issue affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported.

Kimi cli: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

parsedmarc

pyasn1 versions 0.6.4 and earlier contain a denial-of-service vulnerability due to quadratic-time complexity in decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This occurs because the decoder repeatedly copies accumulated fragments, causing CPU exhaustion when processing attacker-controlled ASN.1 inputs with many fragments. The issue affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5 (high severity).

Parsedmarc: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

ansible@13

pyasn1 versions 0.6.4 and earlier contain a quadratic-time denial of service vulnerability in decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This flaw causes excessive CPU consumption when processing many fixed-size fragments, potentially leading to CPU exhaustion if attacker-controlled ASN.1 input is decoded without proper limits. The issue affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impacts are reported. The vulnerability has a CVSS score of 7.5, indicating high severity.

Ansible@13: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

mistral-vibe

pyasn1 versions 0.6.4 and earlier contain a denial-of-service vulnerability due to quadratic-time complexity when decoding constructed OCTET STRINGs, certain constructed character strings, and indefinite-length ANY types. This occurs because the decoder repeatedly copies accumulated fragments, causing CPU exhaustion with crafted ASN.1 inputs. The issue affects BER and CER decoding paths and certain non-conforming DER inputs when using an asn1Spec. No confidentiality or integrity impacts are reported. The vulnerability has a CVSS score of 7.5 (high severity).

Mistral vibe: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

glances

A denial of service vulnerability exists in pyasn1 versions 0.6.4 and earlier used by Glances, where decoding constructed OCTET STRING or character strings with many fragments causes quadratic CPU time consumption. This occurs due to inefficient string concatenation in BER and CER decoding paths, potentially allowing CPU exhaustion if attacker-controlled ASN.1 input is processed without limits. The issue affects multiple string types and indefinite-length ANY decoding. No confidentiality or integrity impact is reported. Fixed versions 3.1.6.2 and 4.3.3_1 address this issue.

Glances: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

certsync

pyasn1 versions 0.6.4 and earlier contain a quadratic-time denial of service vulnerability in the decoding of constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. The decoder repeatedly concatenates fragments inefficiently, causing CPU usage to grow quadratically with the number of fragments. This can lead to CPU exhaustion if an attacker supplies crafted ASN.1 input to an affected decoder without input or resource limits. The issue affects BER and CER decoding paths and certain non-conforming DER inputs when an asn1Spec is used. No confidentiality or integrity impact is reported.

Certsync: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

pyasn1 versions 0.6.4 and earlier contain a denial-of-service vulnerability due to quadratic-time complexity in decoding constructed OCTET STRINGs, character strings, and indefinite-length ANY types. This occurs when decoding many fixed-size fragments, causing excessive CPU usage. The issue affects BER and CER decoding and certain non-conforming DER inputs. An attacker supplying crafted ASN.1 input to an affected decoder can cause CPU exhaustion. No confidentiality or integrity impact is reported.

Gyb: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

pyasn1 versions up to 0.6.4 have a quadratic-time denial of service vulnerability in decoding constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This flaw causes excessive CPU consumption when processing many small ASN.1 fragments, potentially leading to CPU exhaustion. The issue affects BER and CER decoding and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. A fix is available in version 3.67.1_19.

Dvc: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

gcalcli

pyasn1 versions 0.6.4 and earlier contain a quadratic-time denial of service vulnerability in the decoding of constructed OCTET STRINGs and indefinite-length ANY types. This flaw causes excessive CPU usage when decoding ASN.1 inputs with many fragments, potentially leading to CPU exhaustion. The vulnerability affects BER and CER decoding paths and certain non-standard DER decoding scenarios. No confidentiality or integrity impact is reported. The issue requires attacker-controlled ASN.1 input to the decoder without sufficient input or resource limits.

Gcalcli: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

awscli@1

CVE-2026-119195 is a denial-of-service vulnerability in pyasn1 versions 0.6.4 and earlier, affecting awscli@1 versions >=1.20.20. The flaw causes quadratic-time CPU consumption when decoding constructed OCTET STRINGs or indefinite-length ANY types composed of many fragments, leading to CPU exhaustion. This occurs because the decoder repeatedly concatenates fragments inefficiently, causing excessive CPU use proportional to the square of the number of fragments. The vulnerability impacts BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported.

Awscli@1: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

prowler

pyasn1 versions 0.6.4 and earlier contain a quadratic-time denial of service vulnerability in the decoding of constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. The decoder repeatedly concatenates fragments inefficiently, causing CPU usage to grow quadratically with the number of fragments. This can lead to CPU exhaustion if an attacker supplies crafted ASN.1 input to an affected decoder. The vulnerability affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. The issue is fixed in version 5.47.0.

Prowler: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

s3ql

A denial of service vulnerability exists in pyasn1 versions 0.6.4 and earlier used by s3ql, where decoding constructed OCTET STRING or character strings with many fragments causes quadratic CPU time consumption due to inefficient string concatenation. This affects BER and CER decoding paths and can be triggered by attacker-supplied ASN.1 input, leading to CPU exhaustion without confidentiality or integrity impact. The issue is fixed in s3ql version 3.8.1.

S3ql: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

molecule

pyasn1 versions up to 0.6.4 have a quadratic-time denial of service vulnerability in decoding constructed OCTET STRINGs, character strings, and indefinite-length ANY types. The decoder repeatedly concatenates fragments inefficiently, causing CPU usage to grow quadratically with the number of fragments. This can lead to CPU exhaustion if attacker-controlled ASN.1 input is decoded without proper limits. The issue affects BER and CER decoding and certain non-conforming DER inputs. No confidentiality or integrity impact is reported.

Molecule: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

mcp-google-sheets

A denial of service vulnerability exists in pyasn1 version 0.6.4 and earlier, where decoding constructed OCTET STRING or character strings composed of many fragments causes quadratic-time CPU usage due to repeated copying during string reassembly. This affects BER and CER decoding paths and certain non-DER constructed strings accepted by the DER decoder with schema. An attacker supplying crafted ASN.1 input to an affected decoder can cause CPU exhaustion. No confidentiality or integrity impacts are reported.

Mcp google sheets: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY…

oterm

pyasn1 versions 0.6.4 and earlier contain a quadratic-time denial of service vulnerability in the decoding of constructed OCTET STRINGs, certain constructed character strings, and indefinite-length ANY types. This occurs because the decoder repeatedly concatenates fragments inefficiently, causing CPU usage to grow quadratically with the number of fragments. An attacker supplying crafted ASN.1 input can cause CPU exhaustion in applications that decode such input without proper limits. The vulnerability affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. The CVSS v3.1 base score is 7.5 (high severity).

Oterm: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

hermes-agent

In pyasn1 versions 0.6.4 and earlier used by hermes-agent, a quadratic-time denial of service vulnerability exists in the decoding of constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This flaw causes CPU usage to grow quadratically with the number of fragments during ASN.1 decoding, potentially allowing an attacker to exhaust CPU resources by supplying crafted ASN.1 input. The vulnerability affects BER and CER decoding paths and certain non-conforming DER inputs when an asn1Spec is used. No confidentiality or integrity impact is reported. A fix is available in version 2026.4.30.

Hermes agent: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding…

cve-bin-tool

pyasn1 versions 0.6.4 and earlier contain a vulnerability where decoding constructed OCTET STRINGs or character strings composed of many fragments can cause quadratic-time CPU usage due to repeated copying during string reassembly. This also affects indefinite-length ANY decoding. An attacker supplying crafted ASN.1 input to an affected decoder can cause CPU exhaustion, resulting in a denial of service. The issue affects BER and CER decoding paths and certain non-DER constructed strings accepted by the DER decoder with specific schemas. No confidentiality or integrity impact is reported. The CVSS v3.1 base score is 7.5 (high severity).

Search: CVE-2026-119195