High [CVE-2026-33818] Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
This high-severity Red Hat Linux advisory covers CVE-2026-33818 affecting Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. A flaw was found in the `encoding/asn1` package in Go.
An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.
An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-776.
Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; and 51 more.
Affected products named by the advisory: Red Hat Enterprise Linux 9.6 Extended Update Support; Custom Metric Autoscaler 2.19; external secrets operator for Red Hat OpenShift 1.2; Logging Subsystem for Red Hat OpenShift 6.6; and 47 more.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
- golang-0:1.26.7-1.el10_2
- go-fdo-client-0:1.0.0-4.el10_2.7
- go-fdo-server-0:1.0.1-2.el10_2.4
- golang-github-openprinting-ipp-usb-0:0.9.27-7.el10_2.3
- grafana-0:10.2.6-28.el10_2.5
- grafana-pcp-0:5.3.0-8.el10_2.1
- rhc-1:0.3.8-7.el10_2
- buildah-2:1.43.1-5.el10_2
- buildah-2:1.43.1-6.el10_2
- git-lfs-0:3.7.1-5.el10_2.7
- skopeo-2:1.22.2-5.el10_2
- opentelemetry-collector-0:0.152.1-2.el10_2
- image-builder-0:52.1-1.el10_2.2
- osbuild-composer-0:165.1-3.el10_2.2
- golang-0:1.26.7-1.el10_0
- ignition-0:2.21.0-3.el10_0.4
- delve-0:1.26.1-2.el10_0
- osbuild-composer-0:134.1-12.el10_0
- grafana-pcp-0:5.3.0-1.el10_0.1
- go-toolset:rhel8-8100020260824145918.a3795dee
- grafana-0:9.2.10-33.el8_10
- grafana-pcp-0:5.1.1-18.el8_10
- container-tools:rhel8-8100020260901110702.afee755d
- rhc-1:0.2.5-10.el8_10
- osbuild-composer-0:101.5-2.el8_10
- golang-0:1.26.7-1.el9_8
- grafana-0:10.2.6-23.el9_8.3
- rhc-1:0.2.7-11.el9_8
- grafana-pcp-0:5.1.1-17.el9_8.1
- opentelemetry-collector-0:0.152.1-2.el9_8
- osbuild-composer-0:165.1-4.el9_8.1
- image-builder-0:52.1-1.el9_8.2
- git-lfs-0:3.7.1-4.el9_8.3
- golang-0:1.26.7-1.el9_2
- osbuild-composer-0:76.1-9.el9_2
- ignition-0:2.15.0-2.el9_2.1
- golang-0:1.26.7-1.el9_4
- osbuild-composer-0:101.3-4.el9_4.6
- ignition-0:2.17.0-2.el9_4.2
- golang-0:1.26.7-1.el9_6
- RHSA-2026:60306
- RHSA-2026:62577
- RHSA-2026:62578
- RHSA-2026:62631
- RHSA-2026:63022
- RHSA-2026:63119
- RHSA-2026:63127
- RHSA-2026:63332
- RHSA-2026:64777
- RHSA-2026:64788
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Mitigation
Upgrade to a fixed release: golang-0:1.26.7-1.el10_2, go-fdo-client-0:1.0.0-4.el10_2.7, go-fdo-server-0:1.0.1-2.el10_2.4, golang-github-openprinting-ipp-usb-0:0.9.27-7.el10_2.3, grafana-0:10.2.6-28.el10_2.5, grafana-pcp-0:5.3.0-8.el10_2.1. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.