CVE-2026-119196 affects pyasn1 through version 0.6.4, where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption due to repeated shifting and copying of accumulated data. This can lead to CPU exhaustion and denial of service if attacker-controlled ASN.1 data with many fragments is decoded. The vulnerability impacts BER and CER decoders, and a permissive schema-driven DER decoder path. No confidentiality or integrity impact is reported. The CVSS v3.1 base score is 7.5 (high severity).