CVE-2026-56859: Golang Package Stack Exhaustion Vulnerability Due to Missing Recursion Depth Guard
Summary
CVE-2026-56859: Add recursion depth guard during decode in encoding/xml. Affects golang across 3 version ranges.
< 1.25.13
>= 1.26.0-0, < 1.26.6
>= 1.27.0-0, < 1.27.0
Fixed in 1.25.13, 1.26.6 or 1.27.0, depending on the release line you run. How to fix ↓
Also tracked for
- stdlib · Go
The same CVE-2026-56859 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, developed by Google, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other applications due to its concurrency support and performance. However, the encoding/xml package in Golang has a vulnerability that can lead to stack exhaustion during XML decoding, which can affect applications relying on this functionality.
Vulnerability Detail
The vulnerability arises from the DecodeElement function in the encoding/xml package, which previously reset the depth counter without proper checks. This oversight allows for excessive recursion during XML decoding, potentially leading to stack exhaustion. If exploited, this could cause applications to crash or become unresponsive, posing a significant risk to system stability and availability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.25.131.25.13 -
>= 1.26.0-0, < 1.26.61.26.6 -
>= 1.27.0-0, < 1.27.01.27.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement a manual recursion depth check in your XML decoding logic. This can help mitigate the risk of stack exhaustion until you can update to a patched version. For example, you can limit the depth of XML elements processed and throw an error if the limit is exceeded.
Conclusion
CVE-2026-56859 presents a significant risk to applications using the Golang encoding/xml package due to a stack exhaustion vulnerability. It is crucial to update to the patched versions to ensure system stability and security. Implementing workarounds can provide temporary relief, but updating is the best long-term solution.
See every vulnerability recorded for golang →
FAQ
CVE-2026-56859 is a vulnerability in the Golang encoding/xml package that can lead to stack exhaustion due to a missing recursion depth guard.
If your application uses the encoding/xml package for XML decoding, it may crash or become unresponsive if the vulnerability is exploited.
Versions prior to 1.25.13, 1.26.6, and 1.27.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your manifest file with Vulert, you can determine if your application is affected by this vulnerability.
Implement a manual recursion depth check in your XML decoding logic as a temporary workaround until you can update to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
