encoding/asn1: enforce maximum recursion depth

[thatnealpatel]

Enforce a recursion limit in Unmarshal to prevent stack exhaustion
when parsing deeply-nested, recursive structures.

Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this issue.

This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.

---

This was a PRIVATE track issue, tracked in http://b/499330550.

[thatnealpatel]

Hi @gopherbot, please open backport issues for this security issue.

[gopherbot]

Backport issue(s) opened: #80768 (for 1.25), #80769 (for 1.26).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/814800 mentions this issue: [release-branch.go1.26] encoding/asn1: enforce maximum recursion depth

[gopherbot]

Change https://go.dev/cl/814820 mentions this issue: [release-branch.go1.25] encoding/asn1: enforce maximum recursion depth

[gopherbot]

Change https://go.dev/cl/814860 mentions this issue: [release-branch.go1.27] encoding/asn1: enforce maximum recursion depth

[gopherbot]

Closed by merging CL 814860 (commit 41cb2f3) to release-branch.go1.27.

[gopherbot]

Change https://go.dev/cl/814980 mentions this issue: encoding/asn1: enforce maximum recursion depth