CVE-2026-119196

Name of the Vulnerable Software and Affected Versions pyasn1 versions prior to 0.6.5

Description Constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. When processing attacker-controlled BER (Basic Encoding Rules) or CER (Canonical Encoding Rules) input containing numerous constructed BIT STRING fragments, or schema-driven DER (Distinguished Encoding Rules) with a definite-length constructed BIT STRING, the BitStringPayloadDecoder repeatedly calls BitString.fromOctetString(). This process uses the prior bitString as a prepend, shifting an ever-growing SizedInteger for each fragment, which results in quadratic work. Consequently, large fragmented values can exhaust CPU resources during the decode() function execution.

Recommendations Update pyasn1 to version 0.6.5.