CVE-2026-119197: 
Python vulnerability analysis and mitigation

CVE-2026-119197 is a denial-of-service vulnerability in the pyasn1 Python library caused by quadratic-complexity binary REAL decoding. Affecting all versions up to and including 0.6.4 (vulnerable loop present from v0.2.1 through v0.6.4), the flaw allows an unauthenticated remote attacker to exhaust CPU resources by supplying a crafted ASN.1 REAL value with a large mantissa. The vulnerability was disclosed on October 27, 2026, and fixed in version 0.6.5. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Security Advisory).

The root cause is CWE-407 (Inefficient Algorithmic Complexity) in RealPayloadDecoder.valueDecoder within pyasn1/codec/ber/decoder.py. The decoder builds a binary REAL mantissa one octet at a time using a loop that performs a left-shift on a growing integer (p <<= 8), an OR operation (p |= chunk[0]), and a byte-string suffix copy (chunk = chunk[1:]) for every octet — making decode time O(n²) in mantissa length. Because CER and DER reuse the BER REAL payload decoder, all three codec paths are affected. An attacker only needs to supply attacker-controlled ASN.1 data containing a REAL value that reaches any decode() call; no schema containing REAL is required, and the application does not need to further process the decoded object (GitHub Security Advisory, Fix Commit).

Successful exploitation causes CPU exhaustion on a single core, holding a decoding worker for seconds or longer per crafted request. Benchmarks on v0.6.4 showed BER decode times of ~0.33 s, ~1.3 s, ~6 s, and ~24 s for mantissa sizes of 50,000, 100,000, 200,000, and 400,000 octets respectively, with near-fourfold cost for each doubling of input size. The impact is limited to availability (no confidentiality or integrity loss), but repeated requests can sustain denial-of-service conditions against any service that passes attacker-controlled ASN.1 to pyasn1's BER, CER, or DER decoders (GitHub Security Advisory).

A proof-of-concept Python script is publicly available in the GitHub Security Advisory, demonstrating the quadratic CPU consumption by calling codec.decode() with crafted REAL-encoded ASN.1 input across BER, CER, and DER codecs. No authentication or user interaction is required, and attack complexity is low. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is currently 0.0 (GitHub Security Advisory).

1. Identify target: Locate a network-accessible service that uses pyasn1 ≤ 0.6.4 and passes attacker-controlled data to a BER, CER, or DER decode() call (e.g., SNMP agents, LDAP clients, TLS certificate parsers, or any application accepting ASN.1 input).
2. Craft malicious payload: Construct a binary REAL TLV with a large mantissa. The 0x09 tag identifies REAL; 0x80 0x00 selects a positive base-2 binary value with a one-octet zero exponent, followed by N bytes of 0xff as the mantissa:

def real_value(mantissa_octets):
    content = b"\x80\x00" + b"\xff" * mantissa_octets
    length = len(content).to_bytes(3, "big")
    return b"\x09\x83" + length + content

3. Deliver payload: Send the crafted ASN.1 data to the target application through whatever input channel it accepts (network socket, file upload, protocol message, etc.).
4. Trigger decode: The application passes the data to pyasn1's decode() function, which enters the quadratic mantissa-building loop, consuming one CPU core for seconds or longer.
5. Sustain DoS: Repeat requests with large mantissas (e.g., 200,000+ octets) to maintain CPU saturation and deny service to legitimate users (GitHub Security Advisory).

• Network: Repeated inbound requests containing ASN.1 data with unusually large REAL-encoded values (tag byte 0x09 followed by a long-form length and large payload); abnormally large ASN.1 messages compared to baseline traffic.
• Process: Sustained high CPU utilization (near 100% on a single core) by the Python process handling ASN.1 decoding, particularly during or after receipt of network input; decode operations taking seconds rather than milliseconds.
• Logs: Application logs showing slow or timed-out ASN.1 decode operations; increased error rates or timeouts in services dependent on pyasn1 decoding; log entries correlating high latency with specific source IPs sending large payloads.
• File System: Presence of pyasn1 version 0.6.4 or earlier in the Python environment (pip show pyasn1 returning version ≤ 0.6.4) (GitHub Security Advisory).

Upgrade pyasn1 to version 0.6.5 or later, which replaces the per-octet shift-and-slice loop with a single int.from_bytes(bytes(chunk), 'big') call, reducing mantissa decoding to linear time. The fix is applied in the shared BER payload decoder and covers BER, CER, and DER paths. If immediate upgrade is not possible, reject or strictly limit attacker-controlled ASN.1 input containing REAL values before passing it to pyasn1, and consider deploying rate limiting or CPU quotas on ASN.1 decoding operations to reduce exposure (GitHub Security Advisory, Release v0.6.5).

The vulnerability was reported by multiple researchers credited in the v0.6.5 release notes (manus-use, manus-pi, ucsurf, adriank31), suggesting coordinated responsible disclosure. The fix was merged and released promptly on October 27, 2026, the same day as the advisory publication. A Mastodon post from @thehackerwire noted the disclosure shortly after publication. No major vendor statements or significant media coverage beyond the GitHub advisory have been identified at this time (GitHub Security Advisory, Release v0.6.5).