Package vulnerability, severity high

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

Published October 30, 2026, updated October 31, 2026

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding. Source: GHSA-2qm8-x737-gmw5 (CVE-2026-119196).

What's affected

• pyasn1 (pypi)<0.6.5

What to do

1. Upgrade pyasn1 to 0.6.5 or later.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-2qm8-x737-gmw5

References

• https://osv.dev/vulnerability/GHSA-2qm8-x737-gmw5
• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5
• https://nvd.nist.gov/vuln/detail/CVE-2026-119196
• https://github.com/pyasn1/pyasn1/pull/132
• https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c
• https://github.com/pyasn1/pyasn1
• https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5

Notice ghsa-2qm8-x737-gmw5, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.