CVE-2026-119196 is a denial-of-service vulnerability in pyasn1 versions through 0.6.4 affecting the decoding of constructed BIT STRING values. The decoder repeatedly shifts and copies accumulated data, causing CPU time to grow quadratically with input size. This can lead to CPU exhaustion when processing attacker-controlled ASN.1 data. The vulnerability affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The issue requires untrusted input to reach the vulnerable decoder path and sufficient fragment count to cause exhaustion.