CVE-2026-56859 - Vulnerability Details - OpenCVE

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00185.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Go Standard Library	Encoding/xml

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Go Standard Library	Encoding/xml

References

Link	Providers
https://go.dev/cl/803320
https://go.dev/issue/80481
https://groups.google.com/g/golang-announce/c/94pEornpRlI
https://pkg.go.dev/vuln/GO-2026-6088

History

Fri, 14 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 14 Aug 2026 13:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Go Standard Library Go Standard Library encoding/xml
Vendors & Products		Go Standard Library Go Standard Library encoding/xml

Fri, 14 Aug 2026 01:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-674

Thu, 13 Aug 2026 22:15:00 +0000

Type	Values Removed	Values Added
Description		Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
Title		Add recursion depth guard during decode in encoding/xml
References		https://go.dev/cl/803320 https://go.dev/issue/80481 https://groups.google.com/g/golang-announce/c/94pEornpRlI https://pkg.go.dev/vuln/GO-2026-6088

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2026-08-13T21:58:52.959Z

Updated: 2026-08-14T15:21:46.218Z

Reserved: 2026-06-23T15:10:49.353Z

Link: CVE-2026-56859

Vulnrichment

Updated: 2026-08-14T15:21:41.531Z

NVD

Status : Received

Published: 2026-08-13T22:17:22.320

Modified: 2026-08-14T16:16:57.523

Link: CVE-2026-56859

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-14T12:14:28Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56859", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-06-23T15:10:49.353Z", "datePublished": "2026-08-13T21:58:52.959Z", "dateUpdated": "2026-08-14T15:21:46.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-08-13T21:58:52.959Z"}, "title": "Add recursion depth guard during decode in encoding/xml", "descriptions": [{"lang": "en", "value": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."}], "affected": [{"vendor": "Go standard library", "product": "encoding/xml", "collectionURL": "https://pkg.go.dev", "packageName": "encoding/xml", "versions": [{"version": "0", "lessThan": "1.25.13", "status": "affected", "versionType": "semver"}, {"version": "1.26.0-0", "lessThan": "1.26.6", "status": "affected", "versionType": "semver"}, {"version": "1.27.0-0", "lessThan": "1.27.0-rc.3", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "Decoder.push"}, {"name": "Decoder.pop"}, {"name": "Decoder.RawToken"}, {"name": "Decoder.unmarshalPath"}, {"name": "Decoder.unmarshal"}, {"name": "Decoder.Decode"}, {"name": "Decoder.DecodeElement"}, {"name": "Decoder.Skip"}, {"name": "Decoder.Token"}, {"name": "Unmarshal"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "references": [{"url": "https://go.dev/issue/80481"}, {"url": "https://go.dev/cl/803320"}, {"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"}, {"url": "https://pkg.go.dev/vuln/GO-2026-6088"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-770", "lang": "en", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T15:21:09.615961Z", "id": "CVE-2026-56859", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T15:21:46.218Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56859", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-06-23T15:10:49.353Z", "datePublished": "2026-08-13T21:58:52.959Z", "dateUpdated": "2026-08-14T15:21:46.218Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-08-13T21:58:52.959Z"}, "title": "Add recursion depth guard during decode in encoding/xml", "descriptions": [{"lang": "en", "value": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."}], "affected": [{"vendor": "Go standard library", "product": "encoding/xml", "collectionURL": "https://pkg.go.dev", "packageName": "encoding/xml", "versions": [{"version": "0", "lessThan": "1.25.13", "status": "affected", "versionType": "semver"}, {"version": "1.26.0-0", "lessThan": "1.26.6", "status": "affected", "versionType": "semver"}, {"version": "1.27.0-0", "lessThan": "1.27.0-rc.3", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "Decoder.push"}, {"name": "Decoder.pop"}, {"name": "Decoder.RawToken"}, {"name": "Decoder.unmarshalPath"}, {"name": "Decoder.unmarshal"}, {"name": "Decoder.Decode"}, {"name": "Decoder.DecodeElement"}, {"name": "Decoder.Skip"}, {"name": "Decoder.Token"}, {"name": "Unmarshal"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "references": [{"url": "https://go.dev/issue/80481"}, {"url": "https://go.dev/cl/803320"}, {"url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"}, {"url": "https://pkg.go.dev/vuln/GO-2026-6088"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-56859", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T15:21:09.615961Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T15:21:41.531Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "encoding/xml", "product": "encoding/xml", "programRoutines": [{"name": "Decoder.push"}, {"name": "Decoder.pop"}, {"name": "Decoder.RawToken"}, {"name": "Decoder.unmarshalPath"}, {"name": "Decoder.unmarshal"}, {"name": "Decoder.Decode"}, {"name": "Decoder.DecodeElement"}, {"name": "Decoder.Skip"}, {"name": "Decoder.Token"}, {"name": "Unmarshal"}], "vendor": "Go standard library", "versions": [{"lessThan": "1.25.13", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "1.26.6", "status": "affected", "version": "1.26.0-0", "versionType": "semver"}, {"lessThan": "1.27.0-rc.3", "status": "affected", "version": "1.27.0-0", "versionType": "semver"}]}], "source": "security@golang.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."}], "id": "CVE-2026-56859", "lastModified": "2026-08-14T16:16:57.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56859", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-14T15:21:09.615961Z", "version": "2.0.3"}}]}, "published": "2026-08-13T22:17:22.320", "references": [{"source": "security@golang.org", "url": "https://go.dev/cl/803320"}, {"source": "security@golang.org", "url": "https://go.dev/issue/80481"}, {"source": "security@golang.org", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"}, {"source": "security@golang.org", "url": "https://pkg.go.dev/vuln/GO-2026-6088"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}