CVE-2026-56852: 
cAdvisor Schwachstellenanalyse und -minderung

CVE-2026-56852 is a denial-of-service vulnerability in the golang.org/x/text/unicode/norm package (Go extended text library) where a norm.Iter can enter an infinite loop when processing input containing invalid UTF-8 bytes. It affects all versions of golang.org/x/text/unicode/norm prior to 0.39.0. The vulnerability was published on July 21, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory). The CVE status is currently listed as "Deferred" by the assigning authority (Feedly).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop): the norm.Iter iterator in the Go unicode/norm package fails to advance its internal state when it encounters invalid UTF-8 byte sequences, causing it to loop indefinitely without reaching an exit condition (GitHub Advisory). The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity — an attacker simply needs to supply malformed UTF-8 input to any application that passes user-controlled data through norm.Iter. The fix is tracked in Go issue #80142 and implemented via code review CL 794100. The vulnerability is catalogued as GO-2026-5970 in the Go vulnerability database (Go Vuln DB).

Successful exploitation causes the affected process to hang indefinitely, resulting in a complete loss of availability for any service relying on the vulnerable norm.Iter code path. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service condition. Any Go application that processes externally supplied text through golang.org/x/text/unicode/norm (versions < 0.39.0) is potentially affected, including downstream projects such as Grafana Tempo, Kapacitor, Helm, and Ignition, as evidenced by the broad set of vendor advisories issued (GitHub Advisory).

1. Identify target: Locate a network-accessible Go application that uses golang.org/x/text/unicode/norm versions prior to 0.39.0 and passes user-supplied input to a norm.Iter instance (e.g., text normalization endpoints, search, or input validation features).
2. Craft malformed input: Construct a byte sequence containing one or more invalid UTF-8 byte values (e.g., bytes such as 0xFF, 0xFE, or truncated multi-byte sequences like \xc3\x28) that will be passed to the norm.Iter iterator.
3. Submit the payload: Send the crafted input to the target application via its exposed interface (HTTP request body, query parameter, API field, etc.).
4. Trigger infinite loop: The norm.Iter fails to advance past the invalid byte, entering an infinite loop that consumes CPU and causes the goroutine (and potentially the entire service) to hang indefinitely.
5. Achieve denial of service: The targeted process becomes unresponsive; repeated requests can exhaust available goroutines or CPU resources, taking the service offline (GitHub Advisory, Go Issue).

• Process Behavior: Go application processes exhibiting 100% CPU utilization on a single goroutine with no progress; service health checks timing out or failing.
• Logs: Application logs showing requests that never complete or goroutine dump entries with norm.Iter frames stuck in a tight loop; Go runtime stack traces referencing golang.org/x/text/unicode/norm.
• Network: Repeated inbound requests containing non-UTF-8 byte sequences (e.g., bytes 0xFF, 0xFE, or malformed multi-byte sequences) in text fields processed by the application.
• Availability: Sudden unresponsiveness of services known to use golang.org/x/text (e.g., Grafana Tempo, Kapacitor, Helm) without other apparent cause.

The primary remediation is to upgrade golang.org/x/text to version 0.39.0 or later, which contains the fix for the infinite loop (GitHub Advisory, Go CL 794100). As a workaround prior to patching, applications should validate and sanitize all user-supplied input to reject invalid UTF-8 byte sequences before passing data to norm.Iter (e.g., using utf8.Valid() in Go). Downstream consumers should update their dependencies accordingly; Red Hat, SUSE, and openSUSE have issued multiple errata addressing this CVE in affected packages (Red Hat Errata, SUSE Advisory).

Multiple major Linux distributions and cloud vendors responded promptly with security advisories. Red Hat issued numerous errata (RHSA-2026:43015, 43119, 43554, 43797, 43716, 43803, 43866, 43873, 44151, 44152, 44451, 44479, 46953, 46960, 46988) addressing affected packages (Red Hat Errata). SUSE and openSUSE published several security updates for affected Go-based packages (SUSE Advisory, openSUSE List). The InfluxData community also flagged the issue in relation to Kapacitor binaries (InfluxData Community), and Grafana released Tempo v2.9.4 addressing the vulnerability.