CVE-2026-56852: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-56852 is a Denial of Service vulnerability in the golang.org/x/text/unicode/norm package for Go, where a norm.Iter can enter an infinite loop when processing input containing invalid UTF-8 bytes. It affects all versions of golang.org/x/text prior to 0.39.0. The vulnerability was published on July 21, 2026, and a patch was made available the same day. The CVSS category is estimated as HIGH, with an EPSS score of 0.0 at time of publication (GitHub Advisory, Go Vuln DB).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition — Infinite Loop). The norm.Iter iterator in the golang.org/x/text/unicode/norm package fails to handle malformed UTF-8 byte sequences gracefully, causing the iterator to loop indefinitely without making progress or terminating. An attacker can exploit this by supplying crafted input containing invalid UTF-8 bytes to any application that passes user-controlled data through norm.Iter. No authentication is required, and the precondition is simply that the target application uses the vulnerable norm package to process external input (Go Issue, Go CL, GitHub Advisory).

Successful exploitation causes the affected process to hang indefinitely, resulting in a Denial of Service condition. Any application or service that processes attacker-controlled text through norm.Iter — such as web servers, text normalization pipelines, or data processing tools built with Go — is at risk of becoming unresponsive. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss (GitHub Advisory, Go Vuln DB).

1. Identify target: Locate a Go application or service that uses golang.org/x/text versions prior to 0.39.0 and passes user-supplied input through norm.Iter (e.g., a web API endpoint that normalizes Unicode text).
2. Craft malformed input: Construct a payload containing invalid UTF-8 byte sequences (e.g., bytes such as 0xFF, 0xFE, or truncated multi-byte sequences like \xC0\x80) that will be passed to the norm.Iter iterator.
3. Submit payload: Send the crafted input to the target application via the relevant input vector (HTTP request body, query parameter, file upload, etc.).
4. Trigger infinite loop: The norm.Iter processes the invalid bytes and enters an infinite loop, causing the goroutine or process to hang and consume CPU resources indefinitely, resulting in denial of service (Go Issue, GitHub Advisory).

• Process: Go application processes consuming 100% CPU on a single core with no progress, potentially visible via top or ps as a hung goroutine.
• Logs: Application logs showing requests that never complete or time out; absence of response logs for specific endpoints after receiving certain inputs.
• Network: Repeated requests to text-processing endpoints containing high-byte or non-printable characters in payloads; connections that remain open indefinitely without response.

Upgrade golang.org/x/text to version 0.39.0 or later, which contains the fix for the infinite loop condition (Go CL, Go Vuln DB). As a workaround prior to patching, validate and sanitize all user-supplied input to ensure it is valid UTF-8 before passing it to norm.Iter (e.g., using utf8.Valid() in Go's standard library). Red Hat has also issued security errata (RHSA-2026:43015, RHSA-2026:43119, RHSA-2026:43554) for affected products (Red Hat).

Red Hat issued multiple security advisories (RHSA-2026:43015, RHSA-2026:43119, RHSA-2026:43554) shortly after the vulnerability was published, indicating prompt vendor response for downstream consumers of the Go text package (Red Hat). No significant researcher commentary or broader media coverage has been identified at this time.