CVE-2026-119196 is a denial-of-service vulnerability in pyasn1 through version 0.6.4, where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption. This occurs because the decoder repeatedly shifts and copies the accumulated value for each fragment, leading to CPU exhaustion during decode(). The vulnerability affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The issue can be triggered by attacker-controlled ASN.1 input if the application accepts such input without sufficient limits.