CVE-2026-119196 is a vulnerability in pyasn1 (used by s3ql) versions >=3.1 <3.8.1 and >=6.0.0 where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption. This can lead to CPU exhaustion and denial of service when processing attacker-controlled ASN.1 data. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. A fix is available in version 3.8.1.