7.5 High

CVE-2026-33818 Enforce maximum recursion depth in encoding/asn1

Description

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
encoding/asn1 1.27	earliest → < 1.27.0-rc.3	1.27.0-rc.3
encoding/asn1 1.26	1.26.0-0 → < 1.26.6	1.26.6
encoding/asn1 1.25	earliest → < 1.25.13	1.25.13

References

go.dev go.dev
groups.google.com groups.google.com
go.dev go.dev
pkg.go.dev pkg.go.dev

Timeline

Published August 13, 2026
Last modified November 6, 2026

The 2 CVEs of encoding/asn1 →

CVE-2025-58185 Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion 5.3 Medium

Track this CVE