DecodeElement Stack Exhaustion in Go

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Go Project

Description

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-56859

EUVD

EUVD-2026-58509

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in the DecodeElement function where the depth counter is reset incorrectly. This prevents the counter from triggering, potentially leading to stack exhaustion due to unchecked recursion or excessive memory usage.

Impact Analysis

The vulnerability could cause applications to crash or become unresponsive due to stack exhaustion. This may lead to denial-of-service conditions, disrupting services that rely on the affected component.

Hi! I’m here to help you understand CVE-2026-56859. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70