CVE-2026-119196 affects pyasn1 versions from 1.4.0 up to but not including 3.67.1_19. The vulnerability causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments, potentially leading to CPU exhaustion and denial of service. This occurs because the decoder repeatedly shifts and copies the accumulated value for each fragment. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. A fix is available in version 3.67.1_19.