CVE-2026-56859: 
cAdvisor Análisis y mitigación de vulnerabilidades

CVE-2026-56859 is a Denial of Service vulnerability in Go's standard library encoding/xml package, caused by DecodeElement incorrectly resetting the XML recursion depth counter, preventing it from ever triggering and allowing stack exhaustion via deeply nested XML input. It affects Go versions prior to 1.25.13, 1.26.0–1.26.6, and 1.27.0–1.27.0-rc.3. The vulnerability was published on August 13, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a logic flaw in the DecodeElement function within Go's encoding/xml package, where the recursion depth counter is reset on each call rather than being maintained across recursive invocations (CWE-776: Improper Restriction of Recursive Entity References in DTDs; CWE-770: Allocation of Resources Without Limits or Throttling). Because the depth counter never reaches its intended limit, an attacker can supply a specially crafted XML document with arbitrarily deep nesting to exhaust the call stack. The attack requires no authentication, no user interaction, and is exploitable remotely over the network with low complexity. The fix is tracked under Go issue #80481 and code change CL 803320 (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes stack exhaustion in the affected Go process, resulting in a crash and complete loss of availability for any service that parses untrusted XML using encoding/xml's DecodeElement. There is no impact on confidentiality or data integrity — the vulnerability is purely a Denial of Service condition. Any Go application or service that accepts and decodes XML from external sources is potentially affected, including web APIs, microservices, and data processing pipelines built on vulnerable Go versions (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The vulnerability is classified as automatable (no user interaction required) with network-level access, making it straightforward to trigger against exposed services. The EPSS score is approximately 0.185%, indicating a low near-term exploitation probability. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify services built with vulnerable Go versions (< 1.25.13, 1.26.0–1.26.6, or 1.27.0–1.27.0-rc.3) that accept and parse XML input via encoding/xml's DecodeElement, such as REST APIs, SOAP endpoints, or XML-based data ingestion services.
2. Craft malicious XML payload: Construct an XML document with extremely deep element nesting (e.g., thousands of nested <a> tags) designed to exhaust the Go call stack when recursively decoded.
3. Submit payload: Send the crafted XML document to the target service's XML-parsing endpoint via HTTP POST or another applicable protocol, without requiring any authentication credentials.
4. Trigger stack exhaustion: The DecodeElement function processes the deeply nested XML, repeatedly resetting the depth counter and never triggering the depth limit, causing unbounded recursion and eventual stack overflow, crashing the service.

• Network: Repeated HTTP requests containing large, deeply nested XML payloads sent to XML-processing endpoints; unusually large XML request bodies from a single source IP.
• Logs: Application crash logs or Go runtime panic messages referencing stack overflow or runtime: goroutine stack exceeds errors; sudden process termination events in service logs coinciding with XML parsing activity.
• Process: Unexpected termination or restart of Go-based services; process monitoring alerts for abnormal crash loops in services that handle XML input.

Upgrade to Go 1.25.13, 1.26.6, or 1.27.0-rc.3 (or later), which contain the fix for the DecodeElement depth counter reset bug. No configuration-based workaround is available; the only effective remediation is patching to a fixed Go version. Organizations should prioritize upgrading any internet-facing or externally accessible services that parse XML using encoding/xml. The patch is tracked as Go CL 803320 and advisory GO-2026-6088 (GitHub Advisory, Red Hat Bugzilla).

The Go team disclosed the vulnerability via the golang-announce mailing list on August 14, 2026, alongside the release of patched versions. Red Hat filed a high-severity bug report and engaged a broad set of product security engineers to assess impact across their portfolio. The vulnerability was also picked up by openSUSE, SUSE, Debian, and Yocto Project security channels, indicating broad ecosystem awareness and response (golang-announce, Red Hat Bugzilla).