CVE-2026-56852High· 7.5▾ MidnightPoC available

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score53/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Jul 21, 2026

Updated

Sep 17, 2026

CVSS

7.5

Vendor

Red Hat

Product

Red Hat Enterprise Linux 6

CWE

CWE-835

Depth score

53 · Moderate

EPSS

0.47% · p40

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-23

GitHub PoCs

1 public repository

katekeiroz-dev/golang-x-text ↗

EPSS history

Exploit-prediction probability, daily snapshots since Jul 22.

0.2% → 0.5%▲ 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

11 events · 58 days

Jul 21, 2026Published
Disclosed via CSAF
Jul 22, 2026EPSS first tracked
0.2%
Aug 24, 2026EPSS peak
0.2% → 0.5%
Sep 8, 2026Public exploit observed
1 GitHub repo
Sep 8, 2026CVSS changed
— → 7.5
Sep 8, 2026Severity changed
none → high
Sep 8, 2026CVSS changed
7.5 → —
Sep 8, 2026Severity changed
high → none
Sep 8, 2026CVSS changed
— → 7.5
Sep 8, 2026Severity changed
none → high
Sep 17, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-835 #csaf #vex #red-hat #exploit-available #osv #go

Affected

Patched in

rhem_1_1_for_rhel 10
rhem_1_2_for_rhel 10
rhem_1_1_for_rhel 9
rhem_1_2_for_rhel 9
cert_manager_support_for_red_hat_openshift_release 1.19
cluster_observability_operator 1.5.0
custom_metric_autoscaler 2.19
logging_subsystem_for_red_hat_openshift 6.5
logging_subsystem_for_red_hat_openshift 6.6
openshift_api_for_data_protection 1.5
advanced_cluster_management_for_kubernetes 2.11
advanced_cluster_management_for_kubernetes 2.13
advanced_cluster_management_for_kubernetes 2.14
advanced_cluster_management_for_kubernetes 2.15
advanced_cluster_management_for_kubernetes 2.16
advanced_cluster_management_for_kubernetes 2.17
hardened_images
openshift_service_mesh 3.0
openshift_service_mesh 3.1
openshift_service_mesh 3.2
openshift_service_mesh 3.3
openshift_service_mesh 3.4
openshift_distributed_tracing 3.10.2
openshift_distributed_tracing 3.11.1
openshift_data_foundation 4.22
quay 3.10
quay 3.12
quay 3.15
quay 3.9
external_secrets_operator_for_red_hat_openshift 1.1
external_secrets_operator_for_red_hat_openshift 1.2

Full technical detail▾

Overview

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.

Vendor advisories

RHSA-2026:68334 · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · advisory
RHSA-2026:68335 · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · advisory
RHSA-2026:63135 · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · advisory
RHSA-2026:63138 · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · advisory
RHSA-2026:61314 · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · advisory
RHSA-2026:62866 · Red Hat · fixed in: Custom Metric Autoscaler 2.19 · released 2026-09-02 · advisory
RHSA-2026:56340 · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.5 · released 2026-08-18 · advisory
RHSA-2026:66521 · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · advisory
RHSA-2026:66022 · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · advisory
RHSA-2026:60387 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · advisory
RHSA-2026:60390 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · advisory
Red Hat VEX · Important · affected: AWS Load Balancer Operator, Builds for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Deployment Validation Operator, ExternalDNS Operator, … · no fix planned: MCP Server for Red Hat OpenShift, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, Zero Trust Workload Identity Manager, … · updated 2026-09-17 · vex
RHSA-2026:60388 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · advisory
RHSA-2026:60389 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · advisory
RHSA-2026:60391 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · advisory
RHSA-2026:60386 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · advisory
RHSA-2026:49360 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-01 · advisory
RHSA-2026:44151 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-23 · advisory

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input — rated Important by Red Hat. Released 2026-07-21, updated 2026-09-17.

Affected:

AWS Load Balancer Operator
Builds for Red Hat OpenShift
Compliance Operator
Confidential Compute Attestation
Deployment Validation Operator
ExternalDNS Operator
Fence Agents Remediation Operator
File Integrity Operator
Job Set 1
Job Set Tech Preview
Kernel Module Management Operator for Red Hat Openshift
Kube Descheduler Operator
Leader Worker Set
Lightspeed Core
Machine Deletion Remediation Operator
MCP Server for Red Hat OpenShift
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Migration Toolkit for Virtualization
Multicluster Engine for Kubernetes
Multicluster Global Hub
Network Observability Operator
Node HealthCheck Operator
Node Maintenance Operator
OpenShift Pipelines
OpenShift Run Once Duration Override Operator
OpenShift Secondary Scheduler Operator
OpenShift Serverless
Pen Drive Powered by Red Hat Lightspeed
Power monitoring for Red Hat OpenShift
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Advanced Cluster Security 4
Red Hat Build of Podman Desktop
Red Hat Connectivity Link 1
Red Hat Developer Hub
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat OpenShift Cluster Manager CLI
Red Hat OpenShift Container Platform 4

Fixed:

RHEM 1.1 for RHEL 10
RHEM 1.2 for RHEL 10
RHEM 1.1 for RHEL 9
RHEM 1.2 for RHEL 9
Cert Manager support for Red Hat OpenShift release 1.19
Cluster Observability Operator 1.5.0
Custom Metric Autoscaler 2.19
Logging Subsystem for Red Hat OpenShift 6.5
Logging Subsystem for Red Hat OpenShift 6.6
OpenShift API for Data Protection 1.5
Red Hat Advanced Cluster Management for Kubernetes 2.11
Red Hat Advanced Cluster Management for Kubernetes 2.13
Red Hat Advanced Cluster Management for Kubernetes 2.14
Red Hat Advanced Cluster Management for Kubernetes 2.15
Red Hat Advanced Cluster Management for Kubernetes 2.16
Red Hat Advanced Cluster Management for Kubernetes 2.17
Red Hat Hardened Images
Red Hat OpenShift Service Mesh 3.0
Red Hat OpenShift Service Mesh 3.1
Red Hat OpenShift Service Mesh 3.2
Red Hat OpenShift Service Mesh 3.3
Red Hat OpenShift Service Mesh 3.4
Red Hat OpenShift distributed tracing 3.10.2
Red Hat OpenShift distributed tracing 3.11.1
Red Hat Openshift Data Foundation 4.22
Red Hat Quay 3.10
Red Hat Quay 3.12
Red Hat Quay 3.15
Red Hat Quay 3.9
external secrets operator for Red Hat OpenShift 1.1
external secrets operator for Red Hat OpenShift 1.2

No fix planned:

MCP Server for Red Hat OpenShift
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Advanced Cluster Security 4
Zero Trust Workload Identity Manager
Zero Trust Workload Identity Manager - Tech Preview
AWS Load Balancer Operator
Builds for Red Hat OpenShift
Compliance Operator
Confidential Compute Attestation
Deployment Validation Operator
ExternalDNS Operator
Fence Agents Remediation Operator
File Integrity Operator
Job Set 1
Job Set Tech Preview
Kernel Module Management Operator for Red Hat Openshift
Kube Descheduler Operator
Leader Worker Set
Lightspeed Core
Machine Deletion Remediation Operator
Migration Toolkit for Applications 8
Migration Toolkit for Containers
Migration Toolkit for Virtualization
Multicluster Engine for Kubernetes
Multicluster Global Hub
Network Observability Operator
Node HealthCheck Operator
Node Maintenance Operator
OpenShift Pipelines
OpenShift Run Once Duration Override Operator
OpenShift Secondary Scheduler Operator
OpenShift Serverless
Pen Drive Powered by Red Hat Lightspeed
Power monitoring for Red Hat OpenShift
Red Hat Build of Podman Desktop
Red Hat Connectivity Link 1
Red Hat Developer Hub
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8

Not affected:

RHEM 1.1 for RHEL 10
RHEM 1.2 for RHEL 10
RHEM 1.1 for RHEL 9
RHEM 1.2 for RHEL 9
Cluster Observability Operator 1.5.0
Logging Subsystem for Red Hat OpenShift 6.5
Logging Subsystem for Red Hat OpenShift 6.6
OpenShift API for Data Protection 1.5
Red Hat Advanced Cluster Management for Kubernetes 2.11
Red Hat Advanced Cluster Management for Kubernetes 2.13

Remediation

See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:68334 See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2 https://access.redhat.com/errata/RHSA-2026:68335 Before applying this update, make sure all previously released errata relevant to your system have been applied.

The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift.

If the approval policy is set to Automatic, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting.
If you changed the approval policy to Manual, then you must manually approve the upgrade… https://access.redhat.com/errata/RHSA-2026:63135

Workarounds / mitigations:

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Package advisory (CVE-2026-56852)

Affected packages:

golang.org/x/text < 0.39.0

Patched in:

golang.org/x/text 0.39.0

Source: https://osv.dev/vulnerability/GO-2026-5970

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026Public exploit / PoC published
Sep 8, 2026CVSS — → 7.5
Sep 8, 2026Severity none → high
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026CVSS 7.5 → —
Sep 8, 2026Severity high → none
Sep 8, 2026CVSS — → 7.5
Sep 8, 2026Severity none → high
Sep 8, 2026Public exploit / PoC published
Sep 8, 2026Public exploit flag cleared
Sep 8, 2026Public exploit / PoC published

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#exploit-available#osv#go

← Back to feed