CVE-2026-56859

Awaiting Analysis Awaiting Analysis - Queue

DecodeElement Stack Exhaustion in Go

Publication date: 2026-08-13

Last updated on: 2026-09-03

Assigner: Go Project

Description

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-09-03

Generated

2026-11-08

AI Q&A

2026-08-14

EPSS Evaluated

2026-11-07

NVD

CVE-2026-56859

EUVD

EUVD-2026-58509

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	to 1.25.13 (exc)
golang	go	From 1.26.0-0 (inc) to 1.26.6 (exc)
golang	go	From 1.27.0-0 (inc) to 1.27.0-rc.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in the DecodeElement function where the depth counter is reset incorrectly. This prevents the counter from triggering, potentially leading to stack exhaustion due to unchecked recursion or excessive memory usage.

Detection Guidance

To detect this vulnerability, check the Go version on your system using 'go version'. If your version is before go1.25.13, between go1.26.0-0 and go1.26.5, or between go1.27.0-0 and go1.27.0-rc.2, the system is vulnerable. Use 'go list -m -versions golang.org/x/net' to check dependencies.

Impact Analysis

The vulnerability could cause applications to crash or become unresponsive due to stack exhaustion. This may lead to denial-of-service conditions, disrupting services that rely on the affected component.

Compliance Impact

This vulnerability primarily affects the Go standard library's encoding/xml package, leading to potential stack exhaustion due to improper recursion-depth handling. It does not directly impact compliance with GDPR, HIPAA, or similar standards, as those focus on data protection, privacy, and security controls rather than low-level software vulnerabilities.

Mitigation Strategies

Update to the latest version of Go where this issue has been fixed. Monitor official Go releases for patches addressing CVE-2026-56859.

Hi! I’m here to help you understand CVE-2026-56859. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...