CVE-2026-56859: Add recursion depth guard during decode in encoding/xml

Published Aug 13, 2026

Updated

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Affected Software

1 affected component

encoding/xml DecodeElement

Aug 13, 2026

CVE Published

via MITRE·09:58 PM

Data Sourced

via MITRE·09:58 PM

DescriptionWeakness

CVE-2026-56859 has a risk score of 47, indicating a moderate severity level.

To fix CVE-2026-56859, update the encoding/xml library to the latest version that includes the recursion depth guard.

CVE-2026-56859 affects the DecodeElement function in the encoding/xml package.

CVE-2026-56859 can lead to stack exhaustion due to an improper handling of depth counting during the decoding process.

CVE-2026-56859 was published on August 13, 2026.