CVE-2026-119197: Quadratic Algorithmic Complexity Denial of Service in pyasn1 REAL Mantissa Decoder

Vulnerability ID: CVE-2026-119197
CVSS Score: 7.5
Published: 2026-10-30

An algorithmic complexity vulnerability (CWE-407) in pyasn1 versions prior to 0.6.5 allows unauthenticated attackers to cause a Denial of Service (DoS) via crafted ASN.1 payloads. The flaw resides in the binary-encoded ASN.1 REAL mantissa deserialization routine within RealPayloadDecoder.valueDecoder. By performing iterative byte-string slicing and repeated bitwise shifts on a growing arbitrary-precision integer, the decoder exhibits quadratic time and memory allocation complexity relative to the mantissa length. Supplying a BER-, CER-, or DER-encoded payload with a large REAL mantissa causes excessive CPU consumption and blocks application worker processes.

TL;DR

pyasn1 versions prior to 0.6.5 use an inefficient byte-slicing loop to decode binary-encoded ASN.1 REAL mantissas, resulting in quadratic O(N^2) time complexity. Processing untrusted ASN.1 streams containing large REAL mantissas causes severe CPU exhaustion and Denial of Service.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Type: Inefficient Algorithmic Complexity (CWE-407)
• Affected Component: pyasn1.codec.ber.decoder.RealPayloadDecoder.valueDecoder
• Attack Vector: Network (Unauthenticated BER/CER/DER ASN.1 payloads)
• CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
• EPSS Score: 0.43% (36.83rd Percentile)
• Security Impact: Denial of Service via quadratic O(N^2) CPU and memory copy exhaustion
• Patched Version: pyasn1 0.6.5
• CISA KEV Status: Not Listed

Affected Systems

• pyasn1
• pyasn1: < 0.6.5 (Fixed in: 0.6.5)

Code Analysis

Commit: ce3ec33

Replace quadratic slice-and-shift loop in RealPayloadDecoder.valueDecoder with int.from_bytes(bytes(chunk), 'big')

diff --git a/pyasn1/codec/ber/decoder.py b/pyasn1/codec/ber/decoder.py
index e1b74e11..05525c6a 100644
--- a/pyasn1/codec/ber/decoder.py
+++ b/pyasn1/codec/ber/decoder.py
@@ -587,12 +587,7 @@ def valueDecoder(self, substrate, asn1Spec,

             elif b == 2:  # encbase = 16
                 e *= 4
-            p = 0
-
-            while chunk:  # value
-                p <<= 8
-                p |= chunk[0]
-                chunk = chunk[1:]
+            p = int.from_bytes(bytes(chunk), 'big')

             if fo & 0x40:  # sign bit
                 p = -p

Exploit Details

• GitHub: Upstream unit test cases demonstrating binary REAL mantissa payload construction across BER, CER, and DER decoders.

Mitigation Strategies

• Upgrade pyasn1 to version 0.6.5 or later to replace the O(N^2) byte-slicing loop with O(N) int.from_bytes conversion.
• Enforce strict maximum message size limits on incoming network streams prior to passing buffers to ASN.1 decoders.
• Avoid schemaless ASN.1 decoding (asn1Spec=None) on untrusted inputs; enforce strict asn1Spec schemas that reject unexpected universal tags.
• Apply OS-level CPU resource limits (RLIMIT_CPU) and worker execution timeouts to processes handling unauthenticated ASN.1 data.

Remediation Steps:

1. Identify all Python environments, virtualenvs, and container images utilizing pyasn1 versions prior to 0.6.5.
2. Run 'pip install --upgrade "pyasn1>=0.6.5"' and update dependency lockfiles (requirements.txt, Pipfile.lock, poetry.lock).
3. Restart affected Python services and worker daemons (e.g., LDAP clients, SNMP engines, certificate parsers) to load the patched library.
4. Audit calls to pyasn1 decoder.decode() to ensure explicit asn1Spec schemas and pre-decoding buffer length checks are enforced.

References

• GitHub Security Advisory GHSA-mm57-4v3p-rchx
• pyasn1 Fix Commit ce3ec3390784780a530047e0e77be5ff457636a4
• pyasn1 Pull Request #132
• pyasn1 Release v0.6.5
• NVD Entry for CVE-2026-119197
• CVE.org Record: CVE-2026-119197
• CVE List v5 JSON Record for CVE-2026-119197
• Wiz Vulnerability Database: CVE-2026-119197

Read the full report for CVE-2026-119197 on our website for more details including interactive diagrams and full exploit analysis.