CVE-2026-119196 affects pyasn1 through version 0.6.4, where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption due to repeated shifting and copying operations. This can lead to CPU exhaustion and denial of service when processing sufficiently large, attacker-controlled ASN.1 data. The vulnerability impacts BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The issue arises from inefficient handling of constructed BIT STRING fragments during decoding.