CVE-2026-119197
Description
A flaw was found in pyasn1. A remote attacker can exploit this vulnerability by submitting specially crafted Abstract Syntax Notation One (ASN.1) data containing a binary-encoded floating-point (REAL) value with a large mantissa. Processing this input leads to quadratic decoding time and excessive CPU consumption, resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as Important because unauthenticated remote attackers can cause significant denial of service via CPU starvation in network services that parse untrusted ASN.1 data. While the pyasn1 library is widely packaged across Red Hat Enterprise Linux and containerized application stacks, practical risk requires that an exposed application accepts external input and processes binary-encoded floating-point definitions without schema restrictions. Services handling such untrusted input synchronously within worker threads are primarily vulnerable to CPU exhaustion and availability degradation.
Mitigation
--- CME Mitigation Guidance (2026-11-03) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate iterative per-octet bit-shifting and byte slicing in pyasn1 binary REAL mantissa decoding in favor of linear-time integer conversion: upgrade to pyasn1 0.6.5 (or the corresponding fixed Red Hat builds), which replace the iterative per-octet shifting, bitwise OR, and byte slicing loop with a single linear-time int.from_bytes call, closing crafted ASN.1 payload containing binary-encoded REAL with a large mantissa. Until patched, this is a concern on Applications parsing untrusted ASN.1 input with pyasn1 BER, CER, or DER decoding, so Reject or strictly enforce size limits on untrusted ASN.1 inputs that may contain REAL values. As a compensating measure, Enforce RLIMIT_CPU limits on decoding processes using ulimit or prlimit to terminate workers trapped in quadratic bit-shifting and slicing loops, Impose parsing timeouts or computational limits on decoding operations to bound worker hang time from quadratic mantissa processing, and Throttle client request volume and connections to impede sustained CPU starvation across worker threads. These controls limit blast radius and contain exploitation, but they do not fix the underlying quadratic complexity defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
