CVE-2026-119196 is a high-severity vulnerability in the pyasn1 library (through version 0.6.4) used by gcalcli and potentially other applications. It involves quadratic CPU consumption when decoding constructed BIT STRING values with many fragments, leading to potential denial of service via CPU exhaustion. The vulnerability affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The vulnerability requires attacker-controlled ASN.1 input reaching the decoder and sufficient fragment count to trigger excessive CPU use.