CVE-2026-33818: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-33818 is a Denial of Service vulnerability in the Go standard library's encoding/asn1 package caused by the absence of a recursion limit in the Unmarshal function when parsing deeply-nested, recursive structures. It affects Go versions prior to 1.25.13, 1.26.0–1.26.5, and 1.27.0-rc.0 through 1.27.0-rc.2. The vulnerability was published on August 13, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-776 (Improper Restriction of Recursive Entity References) and CWE-400 (Uncontrolled Resource Consumption). The encoding/asn1 package's Unmarshal function did not enforce any recursion depth limit, allowing a specially crafted ASN.1-encoded input with deeply nested or recursive structures to exhaust the call stack, leading to a stack overflow and process crash. An unauthenticated, remote attacker can trigger this by sending malicious input to any service that parses ASN.1 data using the affected Go standard library — no privileges or user interaction are required (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in stack exhaustion and a crash of the affected service, causing a complete loss of availability for any application that processes untrusted ASN.1 input using the vulnerable Go encoding/asn1 package. There is no impact on confidentiality or data integrity. Services such as TLS certificate parsers, LDAP clients, or any Go application handling ASN.1-encoded data from external sources are at risk (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.178%, indicating a low near-term exploitation probability. However, the attack is automatable and requires no authentication, which increases the theoretical risk for internet-exposed services (GitHub Advisory, Feedly).

1. Reconnaissance: Identify services built with a vulnerable version of Go (< 1.25.13, 1.26.0–1.26.5, or 1.27.0-rc.0–rc.2) that accept and parse ASN.1-encoded input from external sources (e.g., TLS certificate handling, LDAP, SNMP, or custom protocol parsers).
2. Craft malicious payload: Construct an ASN.1-encoded data structure with deeply nested or recursive elements designed to maximize recursion depth when parsed by encoding/asn1.Unmarshal.
3. Deliver payload: Send the crafted ASN.1 input to the target service via the relevant protocol (e.g., as a TLS certificate during a handshake, or as part of an application-layer request).
4. Trigger stack exhaustion: The Unmarshal function recursively processes the nested structure without a depth limit, exhausting the goroutine's stack and causing the Go runtime to crash the process.
5. Achieve denial of service: The target service crashes or becomes unavailable, completing the DoS objective (GitHub Advisory, Red Hat Bugzilla).

• Logs: Sudden, unexpected Go runtime panic messages referencing stack overflow or runtime: goroutine stack exceeds in application logs; crash dumps from Go services processing ASN.1 input.
• Process: Abrupt termination of Go-based services (e.g., exit code indicating signal/panic) without a clear application-level error; repeated service restarts triggered by a process supervisor.
• Network: Unusual or malformed ASN.1-encoded payloads in network traffic directed at services that parse such data; repeated connection attempts from the same source immediately preceding service crashes.

Upgrade to a patched version of Go: 1.25.13 or later for the 1.25.x branch, 1.26.6 or later for the 1.26.x branch, or 1.27.0-rc.3 or later for the 1.27.x release candidate series. As a short-term workaround, implement input validation to reject excessively nested or large ASN.1 structures before they reach Unmarshal, and consider configuring OS-level resource limits to constrain stack size. Red Hat and SUSE have issued advisories and updated packages for affected distributions (GitHub Advisory, Red Hat Bugzilla, SUSE Advisory).

The Go team announced the fix via the golang-announce mailing list and published the patch as Go change list CL 814980. Red Hat filed a high-severity bug (BZ#2515815) and subsequently issued an errata (RHSA-2026:54836), while SUSE released a security update (SUSE-SU-2026:3640-1) and openSUSE published a corresponding announcement. The vulnerability was also tracked by Debian, Yocto, and Chainguard, reflecting broad downstream ecosystem attention (golang-announce, Red Hat Bugzilla, SUSE Advisory).