Known vulnerabilities in Go standard library encoding/xml
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-56859 | Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion | 7.5 High | Aug 13, 2026 |
| CVE-2022-30633 | Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a… | 7.5 High | Aug 9, 2022 |
| CVE-2022-28131 | Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a… | Not rated | Aug 9, 2022 |