CVE-2026-119196 affects pyasn1 versions through 0.6.4 and causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments. This can lead to CPU exhaustion and denial of service if attacker-controlled ASN.1 data is passed to the decoder. The vulnerability impacts BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The CVSS v3.1 base score is 7.5 (high severity).