The vulnerability exists in Go’s standard library encoding/asn1 package where the Unmarshal function does not impose a maximum recursion depth. An attacker can supply a deeply nested ASN.1 payload that causes the Go runtime to grow the call stack until exhaustion, resulting in a crash or significant slowdown. The flaw aligns with CWE‑400, indicating a resource exhaustion weakness, and also aligns with CWE‑776, indicating a lack of recursion limit checks.

Any system that uses Go’s standard library encoding/asn1 to parse ASN.1 data is potentially affected. No exact version range is provided in the advisory, but references to Go issue 80405 and code review 814980 suggest the problem existed in Go 1.22 and earlier releases until the patch was applied.

The EPSS score of < 1% indicates a low historical probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score of 7.5 reflects high severity. The attack vector is inferred to be via application input channels—either network or local—to which the malicious ASN.1 document is supplied to Unmarshal. While no public exploitation has been reported, an attacker who can inject such input could trigger a stack overflow and deny service to the affected process. The weakness also relates to CWE‑776, highlighting the absence of recursion-limiting safeguards.