CVE-2026-119194 is a vulnerability in the pyasn1 library used by the dvc product that causes quadratic CPU usage when decoding attacker-controlled BER, CER, or DER data without an ASN.1 schema. An attacker can craft inputs with many distinct long tag IDs that cause excessive CPU consumption, potentially leading to denial of service by exhausting CPU resources. The issue affects dvc versions from 1.4.0 up to but not including 3.67.1_19. A fix is available in version 3.67.1_19. No confidentiality or integrity impacts were observed.