CVE-2026-119196 is a high-severity vulnerability in pyasn1 versions from 3.4.0 up to but not including 5.47.0. It causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments, leading to potential CPU exhaustion and denial of service. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. The vulnerability arises from inefficient bit-shifting operations during decoding. A fix is available in pyasn1 version 5.47.0.