CVE-2026-119196
Publication date 29 October 2026
Last updated 11 November 2026
Ubuntu priority
Description
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| pyasn1 | 26.10 stonking |
Fixed in 0.6.4-1ubuntu0.1
|
| 26.04 LTS resolute |
Fixed in 0.6.3-1ubuntu0.2
|
|
| 24.04 LTS noble |
Fixed in 0.4.8-4ubuntu0.4
|
|
| 22.04 LTS jammy |
Fixed in 0.4.8-1ubuntu0.4
|
|
| 20.04 LTS focal |
Fixed in 0.4.2-3ubuntu0.20.04.1~esm2
|
|
| 18.04 LTS bionic |
Fixed in 0.4.2-3ubuntu0.18.04.1~esm2
|
|
| 16.04 LTS xenial |
Fixed in 0.1.9-1ubuntu0.1~esm2
|
|
| 14.04 LTS trusty |
Fixed in 0.1.7-1ubuntu2.1+esm2
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
7.5 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-9011-1
- pyasn1 vulnerabilities
- 9 November 2026