{"id":"CVE-2026-33818","aliases":["GO-2026-5972","BIT-golang-2026-33818"],"title":"Enforce maximum recursion depth in encoding/asn1","summary":"Enforce maximum recursion depth in encoding/asn1","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"stdlib","product":"stdlib","ecosystem":"go","affected":["stdlib >= 1.27.0-0, < 1.27.0-rc.3"],"patched":["stdlib 1.27.0-rc.3"],"published":"2026-08-13","updated":"2026-09-21","sourceUpdated":"2026-09-21T10:56:39.368219814Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5972","references":[{"url":"https://go.dev/issue/80405"},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI"},{"url":"https://go.dev/cl/814980"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33818.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818"},{"url":"https://pkg.go.dev/vuln/GO-2026-5972"},{"url":"https://access.redhat.com/errata/RHSA-2026:68334"},{"url":"https://access.redhat.com/errata/RHSA-2026:68335"},{"url":"https://access.redhat.com/errata/RHSA-2026:66350"},{"url":"https://access.redhat.com/errata/RHSA-2026:66375"},{"url":"https://access.redhat.com/errata/RHSA-2026:66356"},{"url":"https://access.redhat.com/errata/RHSA-2026:68333"},{"url":"https://access.redhat.com/errata/RHSA-2026:65918"},{"url":"https://access.redhat.com/errata/RHSA-2026:67149"},{"url":"https://access.redhat.com/errata/RHSA-2026:61882"},{"url":"https://access.redhat.com/errata/RHSA-2026:67517"},{"url":"https://access.redhat.com/errata/RHSA-2026:66459"},{"url":"https://access.redhat.com/errata/RHSA-2026:65335"},{"url":"https://access.redhat.com/errata/RHSA-2026:67974"},{"url":"https://access.redhat.com/errata/RHSA-2026:66327"},{"url":"https://access.redhat.com/errata/RHSA-2026:63332"},{"url":"https://access.redhat.com/errata/RHSA-2026:64777"},{"url":"https://access.redhat.com/errata/RHSA-2026:64788"},{"url":"https://access.redhat.com/errata/RHSA-2026:62577"},{"url":"https://access.redhat.com/errata/RHSA-2026:62578"},{"url":"https://access.redhat.com/errata/RHSA-2026:60306"},{"url":"https://access.redhat.com/errata/RHSA-2026:63022"},{"url":"https://access.redhat.com/errata/RHSA-2026:63119"},{"url":"https://access.redhat.com/errata/RHSA-2026:65534"},{"url":"https://access.redhat.com/errata/RHSA-2026:62631"},{"url":"https://access.redhat.com/errata/RHSA-2026:65116"},{"url":"https://access.redhat.com/errata/RHSA-2026:65895"},{"url":"https://access.redhat.com/errata/RHSA-2026:63127"},{"url":"https://access.redhat.com/errata/RHSA-2026:64818"},{"url":"https://access.redhat.com/errata/RHSA-2026:63163"},{"url":"https://access.redhat.com/errata/RHSA-2026:60305"},{"url":"https://access.redhat.com/errata/RHSA-2026:62407"},{"url":"https://access.redhat.com/errata/RHSA-2026:63124"},{"url":"https://access.redhat.com/errata/RHSA-2026:64786"},{"url":"https://access.redhat.com/errata/RHSA-2026:62602"}],"tags":["osv","go","csaf","vex","red-hat","cve.org"],"epss":0.00568,"epssPercentile":0.45573,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-14T15:11:19.904646Z"},"cvssSource":"vendor","cwe":["CWE-776","CWE-400"],"ingestedAt":"2026-08-14T19:18:46.489Z","slug":"CVE-2026-33818","body":"## Overview\n\nEnforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.\n\n## Affected packages\n\n- `stdlib >= 1.27.0-0, < 1.27.0-rc.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `stdlib 1.27.0-rc.3`\n\n## Vendor advisories\n\n- **RHSA-2026:68334** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68334)\n- **RHSA-2026:68335** · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68335)\n- **RHSA-2026:66350** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66350)\n- **RHSA-2026:66375** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66375)\n- **RHSA-2026:66356** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66356)\n- **RHSA-2026:68333** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68333)\n- **RHSA-2026:65918** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65918)\n- **RHSA-2026:67149** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67149)\n- **RHSA-2026:61882** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:61882)\n- **RHSA-2026:67517** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67517)\n- **RHSA-2026:66459** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:66459)\n- **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, AWS Load Balancer Operator, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, … · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33818.json)\n- **RHSA-2026:65335** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65335)\n- **RHSA-2026:66327** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66327)\n- **RHSA-2026:63332** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63332)\n- **RHSA-2026:64777** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64777)\n- **RHSA-2026:64788** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64788)\n- **RHSA-2026:62577** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62577)\n- **RHSA-2026:62578** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62578)\n- **RHSA-2026:60306** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60306)\n- **RHSA-2026:63022** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63022)\n- **RHSA-2026:63119** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63119)\n- **RHSA-2026:65534** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65534)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8177,"id":"CVE-2026-33818","ts":1788919966691,"field":"cvss","old":null,"new":"7.5"},{"seq":8176,"id":"CVE-2026-33818","ts":1788919966691,"field":"severity","old":"none","new":"high"},{"seq":7986,"id":"CVE-2026-33818","ts":1788919254048,"field":"cvss","old":"7.5","new":null},{"seq":7985,"id":"CVE-2026-33818","ts":1788919254048,"field":"severity","old":"high","new":"none"},{"seq":7795,"id":"CVE-2026-33818","ts":1788916327588,"field":"cvss","old":null,"new":"7.5"},{"seq":7794,"id":"CVE-2026-33818","ts":1788916327588,"field":"severity","old":"none","new":"high"},{"seq":7604,"id":"CVE-2026-33818","ts":1788915271673,"field":"cvss","old":"7.5","new":null},{"seq":7603,"id":"CVE-2026-33818","ts":1788915271673,"field":"severity","old":"high","new":"none"},{"seq":7413,"id":"CVE-2026-33818","ts":1788912687132,"field":"cvss","old":null,"new":"7.5"},{"seq":7412,"id":"CVE-2026-33818","ts":1788912687132,"field":"severity","old":"none","new":"high"},{"seq":7222,"id":"CVE-2026-33818","ts":1788911303999,"field":"cvss","old":"7.5","new":null},{"seq":7221,"id":"CVE-2026-33818","ts":1788911303999,"field":"severity","old":"high","new":"none"},{"seq":7029,"id":"CVE-2026-33818","ts":1788909056015,"field":"cvss","old":null,"new":"7.5"},{"seq":7028,"id":"CVE-2026-33818","ts":1788909056015,"field":"severity","old":"none","new":"high"},{"seq":6841,"id":"CVE-2026-33818","ts":1788907368261,"field":"cvss","old":"7.5","new":null},{"seq":6840,"id":"CVE-2026-33818","ts":1788907368261,"field":"severity","old":"high","new":"none"},{"seq":6817,"id":"CVE-2026-33818","ts":1788905597504,"field":"cvss","old":null,"new":"7.5"},{"seq":6816,"id":"CVE-2026-33818","ts":1788905597504,"field":"severity","old":"none","new":"high"}]}