CVE-2026-33818
CVE
High
Medium Impactencoding/asn1: Stack Exhaustion via Unbounded Recursion in Unmarshal
Exploitable under specific conditions
This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.
Reachable when KrakenD parses an attacker-supplied X.509 certificate, for example a
client certificate presented during mTLS authentication, or a backend certificate
validated during outbound TLS. Deployments without client certificate validation
enabled are not exposed to externally-supplied certificates through this path.
Component
Go standard library (encoding/asn1)
Disclosed
Aug 14, 2026
Description
Go’s
encoding/asn1 package, used to decode ASN.1 DER structures such as X.509
certificates, did not enforce a recursion limit in Unmarshal. A deeply-nested,
recursive ASN.1 structure, such as a maliciously crafted certificate, could drive the
decoder into unbounded recursion and exhaust the goroutine’s stack, crashing the
process. The fix adds a recursion depth guard.Version summary
Community Edition
2.13.9
addresses this advisory
Affected CE versions
>= 2.0, < 2.13.9
Enterprise Edition
2.13.7
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.7
Upgrade to the addressed version or later to remediate this vulnerability.