apache-superset

A high-severity security vulnerability (CVE-2026-119197) affects the apache-superset package versions prior to 6.1.0-r8. The issue involves the pyasn1 component, which is a generic ASN. The vulnerability has an impact on availability but does not affect confidentiality or integrity. A fix is available in version 6.1.0-r8.

Apache superset: pyasn1 is a generic ASN (CVE-2026-119197)

smbclient-ng

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity relative to the mantissa size, causing excessive CPU consumption. This affects BER, CER, and DER decoders using the vulnerable RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5. Applications passing attacker-controlled ASN.1 REAL values to these decoders without proper input limits may be vulnerable to CPU exhaustion during decoding.

Smbclient ng: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

scoutsuite

pyasn1 versions up to 0.6.4 have a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in CPU time relative to mantissa length, causing high CPU usage and potential exhaustion. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5 by optimizing the decoding loop.

Scoutsuite: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

kimi-cli

CVE-2026-119197 is a denial-of-service vulnerability in pyasn1 versions 0.6.4 and earlier affecting the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity due to inefficient byte-wise processing, causing excessive CPU consumption. This impacts BER, CER, and DER decoders that use the vulnerable RealPayloadDecoder. The vulnerability allows an attacker who can supply crafted ASN.1 input containing REAL values to cause CPU exhaustion during decoding. The issue is fixed in pyasn1 version 0.6.5 by replacing the inefficient loop with a more efficient integer conversion. Until patched, applications should limit or reject attacker-controlled ASN.1 input with REAL values.

Kimi cli: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

parsedmarc

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity relative to the mantissa size, causing excessive CPU consumption. This affects BER, CER, and DER decoders that use the shared RealPayloadDecoder. The vulnerability can be triggered when an application decodes attacker-controlled ASN.1 data containing REAL values without proper input restrictions. The issue is fixed in pyasn1 version 0.6.5.

Parsedmarc: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

ansible@13

pyasn1 versions up to 0.6.4 have a denial-of-service vulnerability in decoding binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in the mantissa length, causing excessive CPU consumption. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. An attacker supplying crafted ASN.1 REAL values to an application using these decoders can cause CPU exhaustion during decoding. The issue is fixed in pyasn1 version 0.6.5.

Ansible@13: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

mistral-vibe

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity relative to the mantissa size, causing excessive CPU consumption during decoding. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. The vulnerability can be triggered by attacker-controlled ASN.1 input containing REAL values. A fix is available in pyasn1 version 0.6.5.

Mistral vibe: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

glances

CVE-2026-119197 is a denial of service vulnerability in pyasn1 versions up to 0.6.4 used by Glances. It arises from a quadratic-complexity loop in decoding binary-encoded ASN.1 REAL values with large mantissas, causing excessive CPU consumption. The flaw affects BER, CER, and DER decoders. An attacker supplying crafted ASN.1 REAL data to an affected decoder can cause CPU exhaustion during decoding. The issue is fixed in pyasn1 0.6.5. Users should upgrade to this version or apply input restrictions to mitigate the risk.

Glances: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

certsync

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process uses a quadratic-time algorithm that can exhaust CPU resources when processing attacker-controlled input. This affects BER, CER, and DER decoders that use the vulnerable RealPayloadDecoder. The issue is fixed in pyasn1 version 0.6.5.

Certsync: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

pyasn1 versions up to 0.6.4 have a denial-of-service vulnerability in decoding binary-encoded ASN.1 REAL values with large mantissas. The decoding process uses a quadratic-time algorithm that can exhaust CPU resources when processing attacker-controlled input. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5 by replacing the inefficient loop with a more efficient integer conversion.

Gyb: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in the mantissa length, causing excessive CPU consumption when processing attacker-controlled input. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The vulnerability is fixed in pyasn1 version 0.6.5. Applications using vulnerable versions should upgrade or limit input containing REAL values.

Dvc: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

gcalcli

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary ASN.1 REAL values with large mantissas. The decoding process is quadratic in the mantissa length, causing excessive CPU consumption. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5. Applications passing attacker-controlled ASN.1 REAL values to these decoders without proper input limits are vulnerable to CPU exhaustion during decoding.

Gcalcli: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

awscli@1

CVE-2026-119197 is a denial of service vulnerability in pyasn1 versions 0.6.4 and earlier, affecting the decoding of binary ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity due to inefficient byte processing, causing excessive CPU consumption. This impacts BER, CER, and DER decoders using the vulnerable RealPayloadDecoder. The vulnerability can be triggered when an application decodes attacker-controlled ASN.1 data containing REAL values. The issue was fixed in pyasn1 version 0.6.5 by optimizing the decoding loop.

Awscli@1: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

prowler

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in the mantissa length, causing excessive CPU consumption when processing crafted inputs. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The issue is fixed in pyasn1 version 0.6.5.

Prowler: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

s3ql

CVE-2026-119197 is a denial of service vulnerability in pyasn1 versions 0.6.4 and earlier. It arises from a quadratic-complexity loop in decoding binary ASN.1 REAL values with large mantissas, causing excessive CPU consumption. The flaw affects BER, CER, and DER decoders using the RealPayloadDecoder. An attacker supplying crafted ASN.1 data with large REAL values can cause CPU exhaustion during decoding. The issue is fixed in pyasn1 0.6.5. Applications using affected pyasn1 versions should upgrade or limit input containing REAL values.

S3ql: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

molecule

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process uses a quadratic-time algorithm that can cause high CPU usage and exhaustion when processing attacker-controlled input. This affects BER, CER, and DER decoders. The issue is fixed in pyasn1 version 0.6.5.

Molecule: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

mcp-google-sheets

CVE-2026-119197 is a denial of service vulnerability in pyasn1 versions 0.6.4 and earlier. It arises from a quadratic-complexity loop in the decoding of binary-encoded ASN.1 REAL values with large mantissas. This can cause excessive CPU consumption during decoding, potentially exhausting a CPU core for seconds or longer. The flaw affects BER, CER, and DER decoders using the RealPayloadDecoder. The issue is fixed in pyasn1 version 0.6.5.

Mcp google sheets: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

oterm

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity due to inefficient byte-wise processing, causing excessive CPU consumption when handling crafted inputs. This affects BER, CER, and DER decoders that use the shared RealPayloadDecoder. The issue is fixed in pyasn1 0.6.5 by replacing the inefficient loop with a more efficient integer conversion.

Oterm: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

hermes-agent

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in CPU time relative to mantissa length, causing excessive CPU consumption during decode operations. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. The issue is fixed in pyasn1 version 0.6.5. Applications passing attacker-controlled ASN.1 REAL values to these decoders without strict input limits are vulnerable to CPU exhaustion.

Hermes agent: pyasn1 has quadratic-complexity denial of service in binary REAL decoding (CVE-2026-119197)

cve-bin-tool

pyasn1 versions 0.6.4 and earlier contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process uses a quadratic-time algorithm that can exhaust CPU resources when processing attacker-controlled input. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. The issue is fixed in pyasn1 version 0.6.5 by replacing the inefficient loop with a more efficient integer conversion.

Search: CVE-2026-119197