CVE-2026-56859: 
Go vulnerability analysis and mitigation

CVE-2026-56859 is a Denial of Service vulnerability in Go's standard library encoding/xml package, caused by DecodeElement incorrectly resetting the recursion depth counter, preventing it from ever triggering and allowing stack exhaustion via deeply nested XML input. It affects Go versions prior to 1.25.13, 1.26.0–1.26.6, and 1.27.0–1.27.0-rc.3. The vulnerability was published on August 13, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a logic flaw in the DecodeElement function within Go's encoding/xml package, where the recursion depth counter is reset on each call rather than being properly maintained across recursive invocations (CWE-776: Improper Restriction of Recursive Entity References in DTDs; CWE-770: Allocation of Resources Without Limits or Throttling). Because the depth counter never reaches its intended limit, an attacker can supply crafted XML with arbitrarily deep nesting to trigger unbounded recursion and exhaust the call stack. The fix is tracked in Go issue #80481 and applied via code change CL 803320. The vulnerability is catalogued as GO-2026-6088 in the Go vulnerability database (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a stack exhaustion crash of any Go application that uses encoding/xml's DecodeElement to parse untrusted XML input, causing a complete loss of availability for the affected service. There is no impact on confidentiality or data integrity. The attack is fully automatable and requires no authentication or user interaction, making it straightforward to use for denial-of-service against internet-facing Go services (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time. The NVD SSVC assessment classifies exploitation as "none" and technical impact as "partial," though the attack is rated "automatable" due to the network-accessible, no-authentication-required attack vector. The EPSS score is approximately 0.185% (0.568% per GitHub Advisory), placing it in the lower-to-mid range of exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify target: Locate internet-facing services built with Go that accept and parse XML input using encoding/xml's DecodeElement, running Go versions prior to 1.25.13, 1.26.6, or 1.27.0-rc.3.
2. Craft malicious XML: Construct an XML document with deeply nested elements (e.g., thousands of levels of <a><a><a>...</a></a></a>) designed to trigger recursive calls to DecodeElement.
3. Submit payload: Send the crafted XML to the target service's XML-parsing endpoint via HTTP, API call, or any other supported input channel.
4. Trigger stack exhaustion: Because DecodeElement resets the depth counter on each invocation, the recursion limit is never enforced, causing the Go runtime to exhaust the goroutine stack and crash the service process.
5. Achieve DoS: The target service crashes or becomes unresponsive, resulting in denial of service for legitimate users (GitHub Advisory, Red Hat Bugzilla).

• Network: Repeated large or deeply nested XML payloads sent to service endpoints that accept XML input; unusual spikes in request size targeting XML-parsing APIs.
• Logs: Application crash logs or panic stack traces from Go runtime referencing encoding/xml or DecodeElement; goroutine stack overflow messages in service logs.
• Process: Unexpected termination or restart of Go-based service processes; high CPU usage followed by abrupt process exit consistent with stack exhaustion.

Upgrade to a patched version of Go: 1.25.13 or later (for the 1.25.x branch), 1.26.6 or later (for the 1.26.x branch), or 1.27.0-rc.3 or later (for the 1.27.x pre-release branch). Red Hat has issued errata RHSA-2026:60304 (RHEL 9), RHSA-2026:60305 (RHEL 8), and RHSA-2026:60306 (RHEL 10) addressing this issue. SUSE has released updates SUSE-SU-2026:3640-1, SUSE-SU-2026:3799-1, SUSE-SU-2026:3815-1, and SUSE-SU-2026:3830-1. As a temporary workaround where upgrading is not immediately possible, avoid passing untrusted XML input to DecodeElement, or implement application-level XML depth/size limits before parsing (GitHub Advisory, Red Hat Bugzilla).

The Go team announced the fix via the golang-announce mailing list, and the issue was also disclosed on the oss-security mailing list. The vulnerability received standard coverage from Linux distribution security teams (Red Hat, SUSE, openSUSE, Debian, AlmaLinux, Rocky Linux) and security scanning vendors (Tenable, Qualys). No notable independent researcher commentary or significant social media discussion beyond routine security advisory tracking has been observed (golang-announce, Red Hat Bugzilla).