CVE-2026-33818: Enforce maximum recursion depth in encoding/asn1
Published Aug 13, 2026
·Updated
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
Affected Software
2 affected components
go encoding/asn1
go Unmarshal
Event History
Aug 13, 2026
CVE Published
via MITRE·09:58 PM
Data Sourced
via MITRE·09:58 PM
DescriptionWeakness
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Data Sourced
via Red Hat·10:19 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-33818?
CVE-2026-33818 has a risk rating of 37, indicating moderate severity.
2
How do I fix CVE-2026-33818?
To fix CVE-2026-33818, enforce a maximum recursion depth limit within the Unmarshal function.
3
What software is affected by CVE-2026-33818?
CVE-2026-33818 affects the encoding/asn1 package in Go.
4
When was CVE-2026-33818 published?
CVE-2026-33818 was published on August 13, 2026.
5
What issue does CVE-2026-33818 address in the encoding/asn1 package?
CVE-2026-33818 addresses stack exhaustion caused by parsing deeply-nested, recursive structures.