{"id":"CVE-2026-56852","aliases":["GO-2026-5970"],"title":"Infinite loop on invalid input in golang.org/x/text","summary":"Infinite loop on invalid input in golang.org/x/text","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"x","product":"golang.org/x/text","ecosystem":"go","affected":["golang.org/x/text < 0.39.0"],"patched":["golang.org/x/text 0.39.0"],"published":"2026-07-14","updated":"2026-09-23","sourceUpdated":"2026-09-23T10:41:39.386264978Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5970","references":[{"url":"https://go.dev/issue/80142"},{"url":"https://go.dev/cl/794100"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56852.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-56852"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2504233"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56852"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56852"},{"url":"https://pkg.go.dev/vuln/GO-2026-5970"},{"url":"https://access.redhat.com/errata/RHSA-2026:68334"},{"url":"https://access.redhat.com/errata/RHSA-2026:68335"},{"url":"https://access.redhat.com/errata/RHSA-2026:63135"},{"url":"https://access.redhat.com/errata/RHSA-2026:63138"},{"url":"https://access.redhat.com/errata/RHSA-2026:61314"},{"url":"https://access.redhat.com/errata/RHSA-2026:62866"},{"url":"https://access.redhat.com/errata/RHSA-2026:56340"},{"url":"https://access.redhat.com/errata/RHSA-2026:66521"},{"url":"https://access.redhat.com/errata/RHSA-2026:66022"},{"url":"https://access.redhat.com/errata/RHSA-2026:60387"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"url":"https://access.redhat.com/errata/RHSA-2026:60389"},{"url":"https://access.redhat.com/errata/RHSA-2026:60391"},{"url":"https://access.redhat.com/errata/RHSA-2026:60386"},{"url":"https://access.redhat.com/errata/RHSA-2026:49360"},{"url":"https://access.redhat.com/errata/RHSA-2026:44151"},{"url":"https://access.redhat.com/errata/RHSA-2026:44451"},{"url":"https://access.redhat.com/errata/RHSA-2026:44430"},{"url":"https://access.redhat.com/errata/RHSA-2026:46953"},{"url":"https://access.redhat.com/errata/RHSA-2026:48306"},{"url":"https://access.redhat.com/errata/RHSA-2026:40964"},{"url":"https://access.redhat.com/errata/RHSA-2026:41020"},{"url":"https://access.redhat.com/errata/RHSA-2026:42083"},{"url":"https://access.redhat.com/errata/RHSA-2026:42241"},{"url":"https://access.redhat.com/errata/RHSA-2026:42230"},{"url":"https://access.redhat.com/errata/RHSA-2026:43873"},{"url":"https://access.redhat.com/errata/RHSA-2026:43801"}],"tags":["osv","go","exploit-available","csaf","vex","red-hat"],"epss":0.00475,"epssPercentile":0.40231,"exploits":{"github":1,"githubRepos":["https://github.com/katekeiroz-dev/golang-x-text"],"checkedAt":"2026-09-24T07:16:36.326Z"},"exploitAvailable":true,"cvssSource":"vendor","cwe":["CWE-835"],"ingestedAt":"2026-07-22T15:33:23.707Z","slug":"CVE-2026-56852","body":"## Overview\n\nA norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.\n\n## Affected packages\n\n- `golang.org/x/text < 0.39.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `golang.org/x/text 0.39.0`\n\n## Vendor advisories\n\n- **RHSA-2026:68334** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68334)\n- **RHSA-2026:68335** · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68335)\n- **RHSA-2026:63135** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63135)\n- **RHSA-2026:63138** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63138)\n- **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314)\n- **RHSA-2026:62866** · Red Hat · fixed in: Custom Metric Autoscaler 2.19 · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62866)\n- **RHSA-2026:56340** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.5 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56340)\n- **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521)\n- **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022)\n- **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387)\n- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)\n- **Red Hat VEX** · Important · affected: AWS Load Balancer Operator, Builds for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Deployment Validation Operator, ExternalDNS Operator, … · no fix planned: MCP Server for Red Hat OpenShift, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, Zero Trust Workload Identity Manager, … · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56852.json)\n- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)\n- **RHSA-2026:60389** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60389)\n- **RHSA-2026:60391** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60391)\n- **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386)\n- **RHSA-2026:49360** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:49360)\n- **RHSA-2026:44151** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44151)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5365,"id":"CVE-2026-56852","ts":1788887272540,"field":"exploit_available","old":"false","new":"true"},{"seq":5364,"id":"CVE-2026-56852","ts":1788887272540,"field":"cvss","old":null,"new":"7.5"},{"seq":5363,"id":"CVE-2026-56852","ts":1788887272540,"field":"severity","old":"none","new":"high"},{"seq":4248,"id":"CVE-2026-56852","ts":1788886387457,"field":"exploit_available","old":"true","new":"false"},{"seq":4247,"id":"CVE-2026-56852","ts":1788886387457,"field":"cvss","old":"7.5","new":null},{"seq":4246,"id":"CVE-2026-56852","ts":1788886387457,"field":"severity","old":"high","new":"none"},{"seq":3181,"id":"CVE-2026-56852","ts":1788883133269,"field":"cvss","old":null,"new":"7.5"},{"seq":3180,"id":"CVE-2026-56852","ts":1788883133269,"field":"severity","old":"none","new":"high"},{"seq":3002,"id":"CVE-2026-56852","ts":1788883050793,"field":"exploit_available","old":"false","new":"true"},{"seq":2031,"id":"CVE-2026-56852","ts":1788882455416,"field":"exploit_available","old":"true","new":"false"},{"seq":1105,"id":"CVE-2026-56852","ts":1788881892605,"field":"exploit_available","old":"false","new":"true"}]}