--- id: CVE-2026-56858 aliases: - GO-2026-6091 - BIT-golang-2026-56858 title: Fix Javascript regexp context tracking in html/template summary: Fix Javascript regexp context tracking in html/template severity: high cvss: 8.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N' vendor: stdlib product: stdlib ecosystem: go affected: - 'stdlib >= 1.27.0-0, < 1.27.0-rc.3' patched: - stdlib 1.27.0-rc.3 published: '2026-08-13' updated: '2026-09-25' sourceUpdated: '2026-09-25T10:41:52.899286820Z' source: OSV sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6091' references: - url: 'https://go.dev/issue/80435' - url: 'https://go.dev/cl/807100' - url: 'https://groups.google.com/g/golang-announce/c/94pEornpRlI' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56858.json - url: 'https://access.redhat.com/security/cve/CVE-2026-56858' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2515838' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-56858' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56858' - url: 'https://pkg.go.dev/vuln/GO-2026-6091' - url: 'https://access.redhat.com/errata/RHSA-2026:68334' - url: 'https://access.redhat.com/errata/RHSA-2026:68335' - url: 'https://access.redhat.com/errata/RHSA-2026:66375' - url: 'https://access.redhat.com/errata/RHSA-2026:66356' - url: 'https://access.redhat.com/errata/RHSA-2026:68333' - url: 'https://access.redhat.com/errata/RHSA-2026:65918' - url: 'https://access.redhat.com/errata/RHSA-2026:61882' - url: 'https://access.redhat.com/errata/RHSA-2026:67517' - url: 'https://access.redhat.com/errata/RHSA-2026:66459' - url: 'https://access.redhat.com/errata/RHSA-2026:65335' - url: 'https://access.redhat.com/errata/RHSA-2026:67974' - url: 'https://access.redhat.com/errata/RHSA-2026:66327' - url: 'https://access.redhat.com/errata/RHSA-2026:63332' - url: 'https://access.redhat.com/errata/RHSA-2026:64777' - url: 'https://access.redhat.com/errata/RHSA-2026:60306' - url: 'https://access.redhat.com/errata/RHSA-2026:63022' - url: 'https://access.redhat.com/errata/RHSA-2026:63119' - url: 'https://access.redhat.com/errata/RHSA-2026:65534' - url: 'https://access.redhat.com/errata/RHSA-2026:65116' - url: 'https://access.redhat.com/errata/RHSA-2026:65895' - url: 'https://access.redhat.com/errata/RHSA-2026:64818' - url: 'https://access.redhat.com/errata/RHSA-2026:63163' - url: 'https://access.redhat.com/errata/RHSA-2026:60305' - url: 'https://access.redhat.com/errata/RHSA-2026:62407' - url: 'https://access.redhat.com/errata/RHSA-2026:63124' - url: 'https://access.redhat.com/errata/RHSA-2026:66016' - url: 'https://access.redhat.com/errata/RHSA-2026:62602' - url: 'https://access.redhat.com/errata/RHSA-2026:65359' - url: 'https://access.redhat.com/errata/RHSA-2026:62754' - url: 'https://access.redhat.com/errata/RHSA-2026:62405' - url: 'https://access.redhat.com/errata/RHSA-2026:62753' - url: 'https://access.redhat.com/errata/RHSA-2026:62404' - url: 'https://access.redhat.com/errata/RHSA-2026:65336' tags: - osv - go - csaf - vex - red-hat epss: 0.0031 epssPercentile: 0.2132 cvssSource: vendor cwe: - CWE-79 ingestedAt: '2026-08-14T19:18:46.627Z' --- ## Overview Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. ## Affected packages - `stdlib >= 1.27.0-0, < 1.27.0-rc.3` ## Remediation Upgrade to a patched release: - `stdlib 1.27.0-rc.3` ## Vendor advisories - **RHSA-2026:68334** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68334) - **RHSA-2026:68335** · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68335) - **RHSA-2026:66375** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66375) - **RHSA-2026:66356** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66356) - **RHSA-2026:68333** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68333) - **RHSA-2026:65918** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65918) - **RHSA-2026:61882** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:61882) - **RHSA-2026:67517** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67517) - **RHSA-2026:66459** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:66459) - **RHSA-2026:65335** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65335) - **RHSA-2026:67974** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67974) - **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, AWS Load Balancer Operator, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AI Inference Server, Zero Trust Workload Identity Manager - Tech Preview, Assisted Installer for Red Hat OpenShift Container Platform 2, … · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56858.json) - **RHSA-2026:66327** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66327) - **RHSA-2026:63332** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63332) - **RHSA-2026:64777** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64777) - **RHSA-2026:60306** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60306) - **RHSA-2026:63022** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63022) - **RHSA-2026:63119** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63119) - **RHSA-2026:65534** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65534) - **RHSA-2026:65116** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65116) - **RHSA-2026:65895** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65895) - **RHSA-2026:64818** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64818) - **RHSA-2026:63163** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63163)