CVE-2026-56859: Add recursion depth guard during decode in encoding/xml
Add recursion depth guard during decode in encoding/xml
Other sources
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.8-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56859?
CVE-2026-56859 has a risk score of 47, indicating a moderate severity level.
How do I fix CVE-2026-56859?
To fix CVE-2026-56859, update the encoding/xml library to the latest version that includes the recursion depth guard.
What does CVE-2026-56859 affect?
CVE-2026-56859 affects the DecodeElement function in the encoding/xml package.
What potential issue does CVE-2026-56859 present?
CVE-2026-56859 can lead to stack exhaustion due to an improper handling of depth counting during the decoding process.
When was CVE-2026-56859 published?
CVE-2026-56859 was published on August 13, 2026.