7.5
High
CVE-2026-56859 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion
Description
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| encoding/xml 1.27 | earliest → < 1.27.0-rc.3 | 1.27.0-rc.3 |
| encoding/xml 1.26 | 1.26.0-0 → < 1.26.6 | 1.26.6 |
| encoding/xml 1.25 | earliest → < 1.25.13 | 1.25.13 |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified