---
title: Python parser DoS batch: pyasn1 0.6.5 fixes four quadratic BER/DER decoding bugs, pypdf 6.21.3/6.21.4 fix seven loop and memory bugs | ctxsec
url: https://ctxsec.com/items/pyasn1-0-6-5-pypdf-6-21-4-parser-dos-batch-oct-30
description: "GitHub published four high-severity pyasn1 advisories (CVE-2026-119194 to 119197, CVSS 7.5): crafted BER/CER/DER input causes quadratic CPU use, fixed in 0.6.5. It also published seven pypdf advisories (CVE-2026-119203 to 119209): crafted PDFs cause infinite loops or huge memory use, fixed in 6.21.3 and 6.21.4. Both libraries sit deep in dependency trees (pyasn1 under LDAP, SNMP, Kerberos and google-auth stacks; pypdf under document and RAG ingestion)."
status: "official (GitHub-reviewed advisories, Oct 30)"
published: 2026-11-01
---

> GitHub published four high-severity pyasn1 advisories (CVE-2026-119194 to 119197, CVSS 7.5): crafted BER/CER/DER input causes quadratic CPU use, fixed in 0.6.5. It also published seven pypdf advisories (CVE-2026-119203 to 119209): crafted PDFs cause infinite loops or huge memory use, fixed in 6.21.3 and 6.21.4. Both libraries sit deep in dependency trees (pyasn1 under LDAP, SNMP, Kerberos and google-auth stacks; pypdf under document and RAG ingestion).

[← Cybersecurity News](/news) · [markdown](/items/pyasn1-0-6-5-pypdf-6-21-4-parser-dos-batch-oct-30.md)

official (GitHub-reviewed advisories, Oct 30)

2026-11-01

### Python parser DoS batch: pyasn1 0.6.5 fixes four quadratic BER/DER decoding bugs, pypdf 6.21.3/6.21.4 fix seven loop and memory bugs

GitHub's reviewed advisory database added two Python parser batches on **Oct 30**. Neither is reported exploited, but both libraries are pulled in transitively by many services that parse untrusted input.

- **pyasn1 ≤ 0.6.4 → fix 0.6.5** (all CVSS 3.1 7.5): quadratic CPU in schemaless BER/CER/DER container decoding (**CVE-2026-119194**, GHSA-fm9c-5rcf-2q5p; colliding tag-set hashes); constructed string and indefinite-length ANY decoding (**CVE-2026-119195**); constructed BIT STRING decoding (**CVE-2026-119196**); binary REAL decoding (**CVE-2026-119197**).
- **pypdf → fixes 6.21.3 / 6.21.4** (CVSS 4.0 7.1): infinite loop at EOF during xref trailer search (**CVE-2026-119203**), memory blow-up parsing the page tree (**119204**), infinite loop cloning dictionaries (**119205**), all fixed in **6.21.4**; long runtimes retrieving page labels (**119206**), memory use for exceptions in strict mode (**119207**), encrypted PDFs with a wrong `/Count` (**119208**) and cross-reference stream parsing (**119209**), fixed in **6.21.3**.

**Who should care:** anything that decodes attacker-supplied ASN.1 (LDAP/ldap3, SNMP/pysnmp, Kerberos, certificate tooling, older google-auth/rsa stacks) or ingests user-uploaded PDFs (document pipelines, RAG and agent loaders, mail scanners). **What to do:** pin `pyasn1>=0.6.5` and `pypdf>=6.21.4`, rebuild images, and run PDF parsing in a worker with CPU-time and memory limits so one bad file cannot stall the service.

Sources: [GitHub advisory GHSA-fm9c-5rcf-2q5p (pyasn1, CVE-2026-119194)](https://github.com/advisories/GHSA-fm9c-5rcf-2q5p) · [GitHub advisory GHSA-9m75-vc3g-4x39 (pyasn1, CVE-2026-119195)](https://github.com/advisories/GHSA-9m75-vc3g-4x39) · [GitHub advisory GHSA-2qm8-x737-gmw5 (pyasn1, CVE-2026-119196)](https://github.com/advisories/GHSA-2qm8-x737-gmw5) · [GitHub advisory GHSA-mm57-4v3p-rchx (pyasn1, CVE-2026-119197)](https://github.com/advisories/GHSA-mm57-4v3p-rchx) · [GitHub advisory GHSA-5849-834g-hvw5 (pypdf, CVE-2026-119203)](https://github.com/advisories/GHSA-5849-834g-hvw5) · [GitHub advisory GHSA-62m5-6wh8-28x7 (pypdf, CVE-2026-119208)](https://github.com/advisories/GHSA-62m5-6wh8-28x7)