# CVE-2026-119194: pyasn1 quadratic CPU use in schemaless container decoding

Source: https://junglewise.ai/threats/cve-2026-119194-pyasn1-is-a-generic-asn-1-library-for-python-from-0-3-3-until-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-119194 · Severity: high · CVSS 7.5 · Published 2026-10-29

pyasn1 is a Python library for handling ASN.1 data structures, widely used in cryptography and network protocols. When decoding untrusted BER, CER, or DER-encoded data without a schema, the library performs quadratic computational work due to inefficient tag-set handling, allowing attackers to cause denial of service by exhausting CPU resources.

Technologies: [Pyasn1](https://junglewise.ai/threats/technologies/pyasn1), [pyasn1 (PyPI)](https://junglewise.ai/threats/technologies/pypi-pyasn1). Vendors: [Pyasn1](https://junglewise.ai/threats/vendors/pyasn1), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-119194 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119194 being exploited in the wild.

**How severe is CVE-2026-119194?** High severity, with a CVSS score of 7.5, published 29 October 2026.

**Which products and versions are affected?** Pyasn1 0.3.3 through 0.6.4; pyasn1 (PyPI) >= 0.3.3, < 0.6.5, ECOSYSTEM:introduced=0.3.3,fixed=0.6.5.

**Is there a fix for CVE-2026-119194?** Yes. pyasn1 (PyPI): upgrade to 0.6.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119194 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-119194?** Check whether you run Pyasn1 or pyasn1 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pyasn1 (PyPI): upgrade to 0.6.5 or later

  ```sh
  pip install "pyasn1>=0.6.5"
  ```


## Technical details

A hash-collision vulnerability in ConstructedPayloadDecoderBase._decodeComponentsSchemaless causes quadratic CPU consumption when decoding schemaless containers with attacker-controlled inputs containing many distinct long tag IDs whose TagSet hashes collide. The vulnerability stems from continued insertion into a growing set even though only two distinct tag types need distinguishing. Decoded values and order remain valid, but the algorithmic inefficiency can exhaust decoder CPU and reduce service availability.

## Affected products

- pyasn1 pyasn1 0.3.3 through 0.6.4

## Identifiers

- CVE-2026-119194
- GHSA-fm9c-5rcf-2q5p

## Timeline

- 2026-10-29: disclosed
- 2026-10-27: patched: Release 0.6.5

## References

- [https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86](https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86)
- [https://github.com/pyasn1/pyasn1/pull/132](https://github.com/pyasn1/pyasn1/pull/132)

## Related threats

- [pyasn1 quadratic binary REAL mantissa decoding DoS](https://junglewise.ai/threats/cve-2026-119197-pyasn1-is-a-generic-asn-1-library-for-python-prior-to-0-6-5)
- [pyasn1 quadratic CPU exhaustion in BIT STRING decoding](https://junglewise.ai/threats/cve-2026-119196-pyasn1-is-a-generic-asn-1-library-for-python-prior-to-0-6-5)
- [pyasn1 quadratic algorithm denial of service in ASN.1 decoding](https://junglewise.ai/threats/cve-2026-119195-pyasn1-is-a-generic-asn-1-library-for-python-prior-to-0-6-5)
- [pyasn1 resource consumption in univ.Real float conversion](https://junglewise.ai/threats/cve-2026-59886-pyasn1-resource-consumption-in-univ-real-float-conversion)
- [pyasn1 algorithmic complexity denial of service in OID processing](https://junglewise.ai/threats/cve-2026-59885-pyasn1-algorithmic-complexity-denial-of-service-in-oid-processing)