CVE-2026-119196 is a vulnerability in the pyasn1 library (up to version 0.6.4) used by awscli@1 (versions >=1.20.20). It causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments, leading to potential CPU exhaustion and denial of service during ASN.1 decoding. This affects BER and CER decoders and certain schema-driven DER decoding paths. The vulnerability arises from inefficient bit-shifting operations on accumulated fragments. No confidentiality or integrity impacts are reported.