CVE-2026-33818

Received Received - Intake

Unmarshal Stack Exhaustion via Recursive Structures

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Go Project

Description

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-33818

EUVD

EUVD-2026-58508

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a lack of recursion limit enforcement in the Unmarshal function, which can lead to stack exhaustion when processing deeply-nested or recursive data structures. This may cause the program to crash due to excessive memory or stack usage.

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash applications by sending maliciously crafted input with excessive recursion depth. This may lead to denial-of-service conditions, disrupting services that rely on the affected software.

Mitigation Strategies

Update to the latest version of Go that includes the enforced recursion limit in Unmarshal to prevent stack exhaustion from deeply-nested structures.

Hi! I’m here to help you understand CVE-2026-33818. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70