{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/vex/2026/cve-2026-119196-els_os-debian11els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-30T12:49:34Z",
      "generator": {
        "date": "2026-10-30T12:49:34Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-119196-ELS_OS-DEBIAN11ELS",
      "initial_release_date": "2026-10-29T19:44:46Z",
      "revision_history": [
        {
          "date": "2026-10-29T19:44:46Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-30T12:49:34Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-119196"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 11",
                "product": {
                  "name": "Debian 11",
                  "product_id": "Debian-11",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                "product": {
                  "name": "pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_id": "pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/pypy-pyasn1@0.4.8-1%2Bdeb11u2%2Btuxcare.els1?arch=all"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                "product": {
                  "name": "python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_id": "python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/python3-pyasn1@0.4.8-1%2Bdeb11u2%2Btuxcare.els1?arch=all"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                "product": {
                  "name": "python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_id": "python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/python-pyasn1-doc@0.4.8-1%2Bdeb11u2%2Btuxcare.els1?arch=all"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "all"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all as a component of Debian 11",
          "product_id": "Debian-11:pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all"
        },
        "product_reference": "pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all as a component of Debian 11",
          "product_id": "Debian-11:python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all"
        },
        "product_reference": "python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all as a component of Debian 11",
          "product_id": "Debian-11:python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all"
        },
        "product_reference": "python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
        "relates_to_product_reference": "Debian-11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-119196",
      "notes": [
        {
          "category": "description",
          "text": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "under_investigation": [
          "Debian-11:pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
          "Debian-11:python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
          "Debian-11:python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-119196"
        }
      ],
      "release_date": "2026-10-29T19:44:46Z",
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-10-30T11:24:59.701603Z",
          "details": "Affected",
          "product_ids": [
            "Debian-11:pypy-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all",
            "Debian-11:python-pyasn1-doc-0:0.4.8-1+deb11u2+tuxcare.els1.all",
            "Debian-11:python3-pyasn1-0:0.4.8-1+deb11u2+tuxcare.els1.all"
          ]
        }
      ]
    }
  ]
}