encoding/asn1: Stack Exhaustion via Unbounded Recursion in Unmarshal

Exploitable under specific conditions

This CVE can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

Reachable when KrakenD parses an attacker-supplied X.509 certificate, for example a client certificate presented during mTLS authentication, or a backend certificate validated during outbound TLS. Deployments without client certificate validation enabled are not exposed to externally-supplied certificates through this path.

Component

Go standard library (encoding/asn1)

Disclosed

Aug 14, 2026

Description

Go’s encoding/asn1 package, used to decode ASN.1 DER structures such as X.509 certificates, did not enforce a recursion limit in Unmarshal. A deeply-nested, recursive ASN.1 structure, such as a maliciously crafted certificate, could drive the decoder into unbounded recursion and exhaust the goroutine’s stack, crashing the process. The fix adds a recursion depth guard.

Version summary

Community Edition

2.13.9

addresses this CVE

Affected CE versions

>= 2.0, < 2.13.9

Enterprise Edition

2.13.7

addresses this CVE

Affected EE versions

>= 2.0, < 2.13.7

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-33818 on NVD

Stay up to date with KrakenD releases and important updates