{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/vex/2026/cve-2026-119194-els_os-debian11els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-30T12:49:46Z",
      "generator": {
        "date": "2026-10-30T12:49:46Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-119194-ELS_OS-DEBIAN11ELS",
      "initial_release_date": "2026-10-29T19:38:14Z",
      "revision_history": [
        {
          "date": "2026-10-29T19:38:14Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-30T12:49:46Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-119194"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 11",
                "product": {
                  "name": "Debian 11",
                  "product_id": "Debian-11",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                "product": {
                  "name": "pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_id": "pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/pypy-pyasn1@0.4.8-1%2Bdeb11u2%2Btuxcare.els1?arch=all"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                "product": {
                  "name": "python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_id": "python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/python3-pyasn1@0.4.8-1%2Bdeb11u2%2Btuxcare.els1?arch=all"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                "product": {
                  "name": "python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_id": "python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/python-pyasn1-doc@0.4.8-1%2Bdeb11u2%2Btuxcare.els1?arch=all"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "all"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all as a component of Debian 11",
          "product_id": "Debian-11:pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all"
        },
        "product_reference": "pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all as a component of Debian 11",
          "product_id": "Debian-11:python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all"
        },
        "product_reference": "python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all as a component of Debian 11",
          "product_id": "Debian-11:python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all"
        },
        "product_reference": "python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
        "relates_to_product_reference": "Debian-11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-119194",
      "notes": [
        {
          "category": "description",
          "text": "pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "under_investigation": [
          "Debian-11:pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
          "Debian-11:python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
          "Debian-11:python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-119194"
        }
      ],
      "release_date": "2026-10-29T19:38:14Z",
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-10-30T11:24:58.531105Z",
          "details": "Affected",
          "product_ids": [
            "Debian-11:pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
            "Debian-11:python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
            "Debian-11:python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all"
          ]
        }
      ]
    }
  ]
}