This vulnerability (CVE-2026-33818) affects the Go standard library encoding/asn1 package. The Unmarshal function does not enforce a recursion limit, allowing an attacker to craft deeply nested or recursive ASN.1 data structures that cause stack exhaustion and denial of service. The issue is classified under CWE-400 (Uncontrolled Resource Consumption). The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service).

An attacker can cause a denial of service by triggering stack exhaustion in applications using the vulnerable versions of the encoding/asn1 package when parsing maliciously crafted ASN.1 data. There is no impact on confidentiality or integrity reported.

A fix is available in Go standard library versions 1.25.13, 1.26.6, and 1.27.0-rc.3 and later. Users should upgrade to these or later versions to mitigate the vulnerability. Since this is not a cloud service, remediation depends on applying these updates. No vendor advisory content was provided, so check the official Go release notes for exact patch details.