CVE-2026-56859 Add recursion depth guard during decode in encoding/xml
Attackers can cause stack exhaustion and denial of service by exploiting a missing recursion depth guard in the Go encoding/xml decoder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56859?
CVE-2026-56859 is a high-severity denial of service vulnerability in Go standard library encoding/xml, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
Weakness: CWE-770
Which versions are affected by CVE-2026-56859?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.25.13, 1.26.6, 1.27.0 |
stdlib Go | All versions | 1.25.13, 1.26.6, 1.27.0-rc.3 |
Linux distribution packages (6)
golang1.27 Red Hat:hummingbird:1 | All versions | 0:1.27.0-0.1.hum1 |
golang1.27-bin Red Hat:hummingbird:1 | All versions | 0:1.27.0-0.1.hum1 |
golang1.27-docs Red Hat:hummingbird:1 | All versions | 0:1.27.0-0.1.hum1 |
golang1.27-misc Red Hat:hummingbird:1 | All versions | 0:1.27.0-0.1.hum1 |
golang1.27-src Red Hat:hummingbird:1 | All versions | 0:1.27.0-0.1.hum1 |
golang1.27-tests Red Hat:hummingbird:1 | All versions | 0:1.27.0-0.1.hum1 |
How do I fix CVE-2026-56859?
Upgrade golang to a fixed version for your release line: 1.25.13, 1.26.6 or 1.27.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-56859 being exploited?
There is no known exploitation of CVE-2026-56859 in the wild and no public exploit code.
Sources
Also known as AZL-96641, AZL-96677, AZL-98637, BELL-CVE-2026-56859, BIT-golang-2026-56859, CLEANSTART-2026-AE01464 and 2156 more.