CVE and update status of the FreeBSD ports tree3,560 unaddressed CVEs in 711 portsAll times are CET
CVE details

CVE-2026-119195

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.

Score
7.5 high
Published
2026-10-29
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
devel/py-pyasn1py312-pyasn10.6.4unaddressedmhjacks@swbell.net

Template for a VuXML entry

Check the content

Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>py312-pyasn1 -- FIXME</topic>
    <affects>
      <package>
	<name>py312-pyasn1</name>
	<range><lt>0.6.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-119195: pyasn1 is a generic ASN.1 library for Python. Prior
	  to 0.6.5, constructed string and indefinite-length ANY decoding
	  repeatedly concatenates each fragment onto a growing bytes value.
	  Attacker-controlled BER or CER data can use many constructed OCTET
	  STRING or character-string fragments. DER rejects constructed OCTET
	  STRING without a schema, but accepts its definite-length form when
	  asn1Spec selects univ.OctetString; it also accepts constructed
	  character strings such as UTF8String without a schema, even though
	  those encodings are not valid DER. The separate indefinite-length
	  ANY path is reachable in BER and CER when asn1Spec selects
	  univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder
	  uses growing header concatenation and
	  AnyPayloadDecoder.indefLenValueDecoder uses growing chunk
	  concatenation, repeatedly copying an increasing prefix and causing
	  quadratic work. A sufficiently fragmented value can occupy decoding
	  workers and cause CPU exhaustion without confidentiality or
	  integrity impact. This issue is fixed in version 0.6.5.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-119195</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-119195</url>
    </references>
    <dates>
      <discovery>2026-10-29</discovery>
      <entry>2026-10-30</entry>
    </dates>
  </vuln>