CVE-2026-119195

Name of the Vulnerable Software and Affected Versions pyasn1 versions prior to 0.6.5

Description Constructed string and indefinite-length ANY decoding repeatedly concatenates fragments onto a growing bytes value. When processing attacker-controlled BER (Basic Encoding Rules) or CER (Canonical Encoding Rules) data containing numerous constructed OCTET STRING or character-string fragments, the system performs quadratic work. Specifically, OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix. This can lead to CPU exhaustion by occupying decoding workers if a sufficiently fragmented value is provided.

Recommendations Update to version 0.6.5.