--- id: CVE-2026-56852 aliases: - GO-2026-5970 title: Infinite loop on invalid input in golang.org/x/text summary: Infinite loop on invalid input in golang.org/x/text severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' vendor: x product: golang.org/x/text ecosystem: go affected: - golang.org/x/text < 0.39.0 patched: - golang.org/x/text 0.39.0 published: '2026-07-14' updated: '2026-09-23' sourceUpdated: '2026-09-23T10:41:39.386264978Z' source: OSV sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5970' references: - url: 'https://go.dev/issue/80142' - url: 'https://go.dev/cl/794100' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56852.json - url: 'https://access.redhat.com/security/cve/CVE-2026-56852' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2504233' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-56852' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56852' - url: 'https://pkg.go.dev/vuln/GO-2026-5970' - url: 'https://access.redhat.com/errata/RHSA-2026:68334' - url: 'https://access.redhat.com/errata/RHSA-2026:68335' - url: 'https://access.redhat.com/errata/RHSA-2026:63135' - url: 'https://access.redhat.com/errata/RHSA-2026:63138' - url: 'https://access.redhat.com/errata/RHSA-2026:61314' - url: 'https://access.redhat.com/errata/RHSA-2026:62866' - url: 'https://access.redhat.com/errata/RHSA-2026:56340' - url: 'https://access.redhat.com/errata/RHSA-2026:66521' - url: 'https://access.redhat.com/errata/RHSA-2026:66022' - url: 'https://access.redhat.com/errata/RHSA-2026:60387' - url: 'https://access.redhat.com/errata/RHSA-2026:60390' - url: 'https://access.redhat.com/errata/RHSA-2026:60388' - url: 'https://access.redhat.com/errata/RHSA-2026:60389' - url: 'https://access.redhat.com/errata/RHSA-2026:60391' - url: 'https://access.redhat.com/errata/RHSA-2026:60386' - url: 'https://access.redhat.com/errata/RHSA-2026:49360' - url: 'https://access.redhat.com/errata/RHSA-2026:44151' - url: 'https://access.redhat.com/errata/RHSA-2026:44451' - url: 'https://access.redhat.com/errata/RHSA-2026:44430' - url: 'https://access.redhat.com/errata/RHSA-2026:46953' - url: 'https://access.redhat.com/errata/RHSA-2026:48306' - url: 'https://access.redhat.com/errata/RHSA-2026:40964' - url: 'https://access.redhat.com/errata/RHSA-2026:41020' - url: 'https://access.redhat.com/errata/RHSA-2026:42083' - url: 'https://access.redhat.com/errata/RHSA-2026:42241' - url: 'https://access.redhat.com/errata/RHSA-2026:42230' - url: 'https://access.redhat.com/errata/RHSA-2026:43873' - url: 'https://access.redhat.com/errata/RHSA-2026:43801' tags: - osv - go - exploit-available - csaf - vex - red-hat epss: 0.00475 epssPercentile: 0.38367 exploits: github: 1 githubRepos: - 'https://github.com/katekeiroz-dev/golang-x-text' checkedAt: '2026-09-25T08:21:04.216Z' exploitAvailable: true cvssSource: vendor cwe: - CWE-835 ingestedAt: '2026-07-22T15:33:23.707Z' --- ## Overview A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. ## Affected packages - `golang.org/x/text < 0.39.0` ## Remediation Upgrade to a patched release: - `golang.org/x/text 0.39.0` ## Vendor advisories - **RHSA-2026:68334** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68334) - **RHSA-2026:68335** · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68335) - **RHSA-2026:63135** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63135) - **RHSA-2026:63138** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63138) - **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314) - **RHSA-2026:62866** · Red Hat · fixed in: Custom Metric Autoscaler 2.19 · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62866) - **RHSA-2026:56340** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.5 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56340) - **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521) - **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022) - **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387) - **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390) - **Red Hat VEX** · Important · affected: AWS Load Balancer Operator, Builds for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, Deployment Validation Operator, ExternalDNS Operator, … · no fix planned: MCP Server for Red Hat OpenShift, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, Zero Trust Workload Identity Manager, … · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56852.json) - **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388) - **RHSA-2026:60389** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60389) - **RHSA-2026:60391** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60391) - **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386) - **RHSA-2026:49360** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:49360) - **RHSA-2026:44151** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44151)