Stack Exhaustion Risk in Go Programming Language
CVE-2026-33818

Currently unrated

Key Information:

Vendor: Go Standard Library
Status: Encoding/asn1
Vendor: CVE Published:; 13 August 2026

🔔 Create Go Standard Library Vulnerability Alert

What is CVE-2026-33818?

The Go programming language contains a vulnerability that allows for stack exhaustion through recursive structures during the unmarshalling process. This issue may arise when parsing deeply nested data, leading to potential application crashes and service disruptions. Implementing a recursion limit can mitigate this risk, ensuring that the application remains stable even when handling complex data formats.

Affected Version(s)

encoding/asn1 0 < 1.25.13

encoding/asn1 1.26.0-0 < 1.26.6

encoding/asn1 1.27.0-0 < 1.27.0-rc.3

References

https://go.dev/issue/80405

https://groups.google.com/g/golang-announce/c/94pEornpRlI

https://go.dev/cl/814980

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 13, 2026
Vulnerability Reserved
Mar 23, 2026

Credit

Marwan Atia (marwansamir688@gmail.com)

CVE-2026-33818 Data

JSON