Go encoding/asn1 CVE-2026-33818

ASN.1 (Abstract Syntax Notation One) is a binary encoding format pervasive in cryptographic and network protocols, including X.509 certificates, PKCS standards, TLS, LDAP, and SNMP. Go's standard library encoding/asn1 package provides the Unmarshal function for deserializing ASN.1-encoded byte slices into Go values. The vulnerability is an uncontrolled recursion defect (CWE-674 class): prior to the fix, Unmarshal processed nested ASN.1 SEQUENCE and SET structures via recursive calls with no enforced depth ceiling, allowing a malformed payload with thousands of nested elements to exhaust the goroutine stack and trigger a runtime panic. The fix tracked at https://go.dev/issue/80405 introduces a maximum recursion depth guard inside Unmarshal. Notably, the same Go release batch includes a closely related defect in encoding/xml (CVE-2026-56859) where DecodeElement reset its depth counter, suggesting a systematic review of recursion safety across Go's standard library decoders was performed in this release cycle.