Stack Exhaustion Vulnerability in DecodeElement of Go Programming Language
CVE-2026-56859

7.5HIGH

Key Information:

Vendor: Go Standard Library
Status: Encoding/xml
Vendor: CVE Published:; 13 August 2026

🔔 Create Go Standard Library Vulnerability Alert

What is CVE-2026-56859?

The DecodeElement in the Go programming language contains a flaw where the depth counter gets reset incorrectly, preventing it from firing, which can ultimately lead to stack exhaustion. This vulnerability can impact the application's stability and performance, posing risks during execution. Developers should ensure they are using updated versions of the Go programming language to mitigate this issue and enhance their application's security.

Affected Version(s)

encoding/xml 0 < 1.25.13

encoding/xml 1.26.0-0 < 1.26.6

encoding/xml 1.27.0-0 < 1.27.0-rc.3

References

https://go.dev/issue/80481

https://go.dev/cl/803320

https://groups.google.com/g/golang-announce/c/94pEornpRlI

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 13, 2026
Vulnerability Reserved
Jun 23, 2026

CVE-2026-56859 Data

JSON