CVE-2026-33818: Golang Package Stack Exhaustion Vulnerability Due to Deeply-Nested ASN.1 Structures
Summary
CVE-2026-33818: Enforce maximum recursion depth in encoding/asn1. Affects golang across 3 version ranges.
< 1.25.13
>= 1.26.0-0, < 1.26.6
>= 1.27.0-0, < 1.27.0
Fixed in 1.25.13, 1.26.6 or 1.27.0, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
The same CVE-2026-33818 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Golang package, maintained by Bitnami, is a widely-used programming language known for its simplicity and efficiency in building scalable applications. It provides a rich standard library, including support for encoding and decoding data formats such as ASN.1. However, it is susceptible to a vulnerability that can lead to stack exhaustion when processing deeply-nested recursive structures, potentially causing application crashes or denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2026-33818 arises from the lack of a recursion limit in the Unmarshal function of the encoding/asn1 package. This oversight allows attackers to craft deeply-nested ASN.1 structures that, when parsed, can lead to excessive stack usage and ultimately result in stack exhaustion. The ramifications of this vulnerability include application instability, crashes, and potential denial of service, making it critical for developers to address this issue promptly.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.25.131.25.13 -
>= 1.26.0-0, < 1.26.61.26.6 -
>= 1.27.0-0, < 1.27.01.27.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can limit the depth of ASN.1 structures they process or implement custom parsing logic that checks for recursion depth before invoking the Unmarshal function. However, this is not a permanent solution and should be replaced with an update to the patched version as soon as possible.
Conclusion
CVE-2026-33818 is a critical vulnerability in the Golang package that can lead to stack exhaustion when processing deeply-nested ASN.1 structures. It is essential for developers to update to the patched versions to ensure the stability and security of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for golang →
FAQ
CVE-2026-33818 is a vulnerability in the Golang package that allows for stack exhaustion due to deeply-nested ASN.1 structures.
This vulnerability can lead to application crashes or denial of service, impacting the availability and reliability of your software.
Versions prior to 1.25.13, 1.26.6, and 1.27.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
You should update your Golang package to a patched version (1.25.13 or later, 1.26.6 or later, or 1.27.0) to mitigate this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
