CVE-2026-56859: 
Chainguard vulnerability analysis and mitigation

CVE-2026-56859 is a Denial of Service vulnerability in the Go standard library's encoding/xml package, specifically in the DecodeElement function. The flaw causes DecodeElement to reset the XML depth counter, preventing it from ever firing, which can lead to stack exhaustion when processing specially crafted XML input. It affects Go versions prior to 1.25.13, 1.26.0–1.26.6, and 1.27.0-0–1.27.0-rc.3. The vulnerability was published on August 13, 2026, with a patch released on August 14, 2026. The CVSS category is estimated as HIGH, though a precise numeric score has not been finalized at time of writing (GitHub Advisory, OSV).

The root cause is an improper resource management flaw (CWE-770: Allocation of Resources Without Limits or Throttling) in the encoding/xml package's DecodeElement function. When DecodeElement is called, it incorrectly resets the XML nesting depth counter, meaning the depth limit check never triggers regardless of how deeply nested the XML input is. An attacker can supply a deeply nested or recursive XML document that causes unbounded recursive stack growth, ultimately exhausting the stack and crashing the process. The fix is tracked in Go issue #80481 and code change CL 803320 (GitHub Advisory, OSV).

Successful exploitation results in a Denial of Service: an unauthenticated attacker can send a specially crafted XML payload to any Go application that uses encoding/xml's DecodeElement function, causing the process to exhaust its stack and crash. This affects availability of the targeted service; there is no evidence of confidentiality or integrity impact. Applications that parse untrusted XML input — such as web services, APIs, or data processing pipelines built with Go — are at greatest risk (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is 0.0, indicating very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires no authentication and can be triggered remotely by any application that processes attacker-controlled XML via DecodeElement (GitHub Advisory, OSV).

1. Identify target: Locate a Go application that accepts XML input and internally uses encoding/xml's DecodeElement function (e.g., a REST or SOAP API endpoint, file upload handler, or data processing service).
2. Craft malicious XML: Construct a deeply nested XML document — for example, thousands of levels of nested elements — designed to exceed normal stack depth limits without triggering the (broken) depth counter.
3. Submit payload: Send the crafted XML to the target application via HTTP request, file upload, or any other supported input channel.
4. Trigger stack exhaustion: The DecodeElement function resets the depth counter on each call, allowing unbounded recursion that exhausts the goroutine stack, causing the Go runtime to panic and crash the service (GitHub Advisory, OSV).

• Logs: Go runtime panic messages such as runtime: goroutine stack exceeds or stack overflow in application logs, particularly triggered by XML parsing operations.
• Process: Unexpected application crashes or restarts of Go services that handle XML input; crash dumps referencing encoding/xml stack frames.
• Network: Repeated requests containing large or deeply nested XML payloads sent to XML-consuming endpoints, especially from a single source IP.

Upgrade to Go 1.25.13, 1.26.6, or 1.27.0-rc.3 (or later) to receive the fix for this vulnerability, as detailed in Go CL 803320 and the golang-announce mailing list. No configuration-based workaround is documented; the recommended action is to update the Go toolchain and rebuild affected applications. Organizations should also consider input validation or size limits on XML payloads at the application or API gateway layer as a defense-in-depth measure (GitHub Advisory, golang-announce).

The Go team disclosed the vulnerability via the golang-announce mailing list on August 13–14, 2026, and the fix was published promptly. The issue was also reported to the oss-security mailing list. No notable independent researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking (golang-announce, oss-sec).