CVE-2026-56852: 
cAdvisor 脆弱性の分析と軽減

CVE-2026-56852 is a Denial of Service vulnerability in the golang.org/x/text/unicode/norm package (Go's extended text library) where a norm.Iter iterator can enter an infinite loop when processing input containing invalid UTF-8 bytes. The vulnerability affects all versions of golang.org/x/text prior to 0.39.0 and was published on July 21, 2026. It carries a CVSS v3.1 base score of 7.5 (High), with no confidentiality or integrity impact but full availability impact (GitHub Advisory). Downstream products including IBM Business Automation Workflow containers are also affected (IBM Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). The norm.Iter type in the golang.org/x/text/unicode/norm package fails to properly handle malformed UTF-8 byte sequences, causing the iterator's exit condition to become unreachable and the loop to run indefinitely. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity — an attacker simply needs to supply crafted input containing invalid UTF-8 bytes to any application that passes user-controlled data through norm.Iter. The upstream Go issue is tracked at go.dev/issue/80142 and the fix was applied via go.dev/cl/794100, with the vulnerability catalogued as GO-2026-5970 in the Go vulnerability database (GitHub Advisory).

Successful exploitation causes the affected process to hang indefinitely, resulting in a complete loss of availability for any service relying on the vulnerable norm.Iter code path. There is no confidentiality or integrity impact — attackers cannot read data or modify system state through this vulnerability. The impact scope is limited to the vulnerable component, but in practice any Go application or container that processes untrusted text input through golang.org/x/text/unicode/norm is at risk of a process-level denial of service, potentially requiring a service restart to recover (GitHub Advisory, IBM Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as automatable. The EPSS score is approximately 0.22–0.45%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate a network-accessible Go application or service that accepts user-supplied text input and processes it through the golang.org/x/text/unicode/norm package (e.g., text normalization endpoints, search APIs, or form processors).
2. Craft malformed input: Construct a payload containing invalid UTF-8 byte sequences (e.g., lone continuation bytes such as \x80, overlong encodings, or truncated multi-byte sequences) embedded in otherwise normal text.
3. Submit payload: Send the crafted input to the target application via HTTP request body, query parameter, or any other input channel that feeds data into a norm.Iter iterator.
4. Trigger infinite loop: The norm.Iter processes the invalid bytes and enters an unreachable exit condition, causing the goroutine or process to hang indefinitely.
5. Achieve denial of service: The affected service becomes unresponsive; repeated requests can exhaust worker threads or goroutines, causing a full service outage until the process is restarted (GitHub Advisory).

• Process: Go application processes consuming 100% CPU on a single core with no progress; goroutine dumps showing a norm.Iter call stack stuck in a loop within golang.org/x/text/unicode/norm.
• Logs: Application logs showing requests that never complete or time out; absence of response log entries for specific requests containing non-UTF-8 characters.
• Network: Repeated inbound requests to text-processing endpoints containing high-byte or malformed character sequences (bytes 0x80–0xBF appearing as leading bytes, or sequences like \xfe, \xff).
• Availability: Sudden unresponsiveness of services built on affected Go binaries, particularly following receipt of requests with unusual character encodings.

The primary remediation is to upgrade golang.org/x/text to version 0.39.0 or later, which contains the fix applied in go.dev/cl/794100. Applications should rebuild and redeploy any Go binaries that vendor or depend on this package. As a workaround prior to patching, developers should validate and sanitize all user-supplied input to reject invalid UTF-8 byte sequences before passing data to norm.Iter (e.g., using utf8.Valid() in Go's standard library). IBM has released a patch for IBM Business Automation Workflow containers addressing this issue as of August 2026 (IBM Advisory). Red Hat and SUSE have also issued errata for affected packages in their ecosystems.

Red Hat issued multiple errata (RHSA-2026:43015, RHSA-2026:43119, RHSA-2026:43554, and others) addressing this vulnerability across their product portfolio. SUSE published several security announcements (SUSE-SU-2026:3265-1, SUSE-SU-2026:3300-1, SUSE-SU-2026:3342-1, and others) for affected packages including ignition, helm, apptainer, and google-osconfig-agent. IBM published a security bulletin for Business Automation Workflow containers (IBM Advisory). The InfluxData community also flagged the issue in relation to Kapacitor binaries. Overall community reaction has been routine — the vulnerability is treated as a standard dependency update with no significant controversy or elevated concern.