CVE-2026-33818
published 2026-08-13CVE-2026-33818: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.57%
46.3th percentile
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
Affected
108 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | 3scale-operator-bundle | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| albo | aws-load-balancer-operator | — | — |
| albo | aws-load-balancer-rhel8-operator | — | — |
| ansible-automation-platform-26 | receptor-rhel9 | — | — |
| ansible-automation-platform-27 | receptor-rhel9 | — | — |
| ansible-automation-platform | platform-operator-bundle | — | — |
| apache | thrift | — | — |
| build-of-trustee | trustee-rhel9-operator | — | — |
| buildah_project | buildah | — | — |
| cert-manager | jetstack-cert-manager-rhel9 | — | — |
| compliance | openshift-compliance-operator-bundle | — | — |
| compliance | openshift-selinuxd-rhel8 | — | — |
| confidential-containers | trustee | — | — |
| container-native-virtualization | kubemacpool-rhel9 | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | crun | — | — |
| container-tools_rhel8 | oci-seccomp-bpf-hook | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | runc | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
ghsa_unreviewed·2026-08-14
CVE-2026-33818 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
VulDB
Google Go up to 1.25.12/1.26.5 encoding-asn1 Unmarshal resource consumption
vuldb·2026-08-14
CVE-2026-33818 [LOW] Google Go up to 1.25.12/1.26.5 encoding-asn1 Unmarshal resource consumption
A vulnerability, which was classified as problematic, has been found in Google Go up to 1.25.12/1.26.5. Affected by this issue is the function Unmarshal of the component encoding-asn1. This manipulation causes resource consumption.
The identification of this vulnerability is CVE-2026-33818. It is possible to initiate the attack remotely. There is no exploit available.
It is advisable to upgrade the affected component.
Ubuntu
Go vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 7.5
CVE-2026-56866 [HIGH] Go vulnerabilities
Title: Go vulnerabilities
Summary: Several security issues were fixed in Go.
It was discovered that Go did not enforce a maximum recursion depth when
parsing deeply nested ASN.1 structures. An attacker could possibly use this
issue to cause Go to crash, resulting in a denial of service.
(CVE-2026-33818)
It was discovered that Go incorrectly reset the depth counter when decoding
XML elements. An attacker could possibly use this issue to cause Go to
crash via deeply nested XML input, resulting in a denial of service.
(CVE-2026-56859)
It was discovered that Go incorrectly handled TLS KeyUpdate messages after
the handshake was completed. A remote attacker could possibly use this
issue to cause Go to use excessive resources, leading to a denial of
service. (CVE-2026-56862)
It was discovere
Red Hat
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
vendor_redhat·2026-08-13·CVSS 7.5
CVE-2026-33818 [HIGH] CWE-776 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.
Package: rhai/assisted-installer-rhel9 (Assisted Installer for Red Hat OpenShift Container Platform 2) - Affected
Package: albo/aws-load-balancer-operator (AWS Load Balancer Operator) - Affected
Package: albo/aws-load-balancer-rhel8-operator (AWS Load Balancer Operator) - Affected
Package: openshift-builds/openshift-builds-waiters-rhel9 (Builds for Red Hat OpenShift) - Affected
Package:
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33818 delve: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal [fedora-all]
bugzilla·2026-09-11·CVSS 7.5
CVE-2026-33818 [HIGH] CVE-2026-33818 delve: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal [fedora-all]
CVE-2026-33818 delve: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
Bugzilla
CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
bugzilla·2026-08-13·CVSS 7.5
CVE-2026-33818 [HIGH] CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
2026-08-13
Published