Previously

CVE-2026-56859 is a bug in Go's standard library encoding/xml package — specifically, (*Decoder).DecodeElement resets the recursion-depth counter on every call, meaning the guard that is supposed to prevent unbounded nesting never fires. An attacker sends a trivially-crafted XML document (<a><a><a>… repeated tens of thousands of times) to any Go service that calls Decode, DecodeElement, Unmarshal, Token, RawToken, or Skip on untrusted input. The goroutine's stack exhausts and the Go runtime kills the process with a fatal, unrecoverable panic. Affected Go versions: all branches before 1.25.13, the 1.26 branch before 1.26.6, and the 1.27 release-candidate line before 1.27.0-rc.3.

The vendor rates this HIGH at 7.5, and the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately models the attack surface — unauthenticated, no user interaction, low complexity, availability-only impact. That said, 7.5 is slightly generous for the *typical* enterprise fleet because (a) Go's ecosystem is overwhelmingly JSON-oriented, so the subset of services actually parsing untrusted XML is a minority, and (b) most production Go workloads run in containers with orchestration-level restart policies that limit sustained outage to seconds. We downgrade modestly to 7.0 — still firmly HIGH because the exploit is trivial and the stdlib is ubiquitous, but the practical blast radius and impact ceiling (crash, not compromise) shave half a point.

1. Deploy XML depth-limiting at the ingress layer — Configure your reverse proxy, WAF, or API gateway to reject XML documents exceeding a nesting depth of 100–200 elements. In nginx, use the client_body_buffer_size and a Lua/njs module to inspect depth. In AWS WAF or Cloudflare, use custom rules on XML body inspection. Deploy within 30 days per the noisgate mitigation SLA for HIGH.
2. Recompile affected Go binaries with patched toolchain — Upgrade to Go 1.25.13, 1.26.6, or 1.27.0-rc.3+ and rebuild all binaries that import encoding/xml. Use go version -m <binary> to audit which binaries on your fleet were compiled with a vulnerable Go version. Deploy rebuilt binaries within 180 days per the noisgate remediation SLA for HIGH.
3. Rate-limit XML-accepting endpoints — Apply per-IP and per-endpoint rate limits (e.g., 10 req/s) on any route that accepts XML input. This prevents an attacker from sustaining a CrashLoopBackOff condition even if the vulnerability is present. Most API gateways and ingress controllers support this natively.
4. Upgrade KrakenD if deployed — KrakenD CE users should upgrade to 2.13.9+, EE users to 2.13.7+. If XML encoding/decoding is not used in your KrakenD configuration, the exposure is mitigated but the upgrade should still be applied as defense-in-depth.
5. Enable crash-loop alerting — Ensure Kubernetes CrashLoopBackOff events, systemd rapid-restart conditions, and Go runtime fatal errors (goroutine stack exceeds) trigger PagerDuty/Opsgenie alerts. This ensures active exploitation is detected within minutes.

Run this script on each target host (or via your fleet management tool) to check whether Go binaries compiled with vulnerable toolchains are present. Requires find and go (or the go version binary) on the target. Execute as any user with read access to your Go binary directories: bash check_cve_2026_56859.sh /usr/local/bin /opt/app/bin

#!/usr/bin/env bash
# check_cve_2026_56859.sh — Detect Go binaries vulnerable to CVE-2026-56859
# Usage: bash check_cve_2026_56859.sh [dir1] [dir2] ...
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

VULNERABLE=0
CHECKED=0
SEARCH_DIRS=("${@:-/usr/local/bin /usr/bin /opt}")

if ! command -v go &>/dev/null; then
  echo "[WARN] go binary not found in PATH; attempting to read ELF headers directly."
fi

is_vulnerable_version() {
  local ver="$1"
  # Strip 'go' prefix: go1.25.12 -> 1.25.12
  ver="${ver#go}"
  local major minor patch
  IFS='.' read -r major minor patch <<< "$ver"
  patch="${patch%%[^0-9]*}"  # strip rc/beta suffixes for base comparison
  
  # 1.25.x: vulnerable if patch < 13
  if [[ "$minor" -eq 25 ]] && [[ "${patch:-0}" -lt 13 ]]; then
    return 0
  fi
  # 1.26.x: vulnerable if patch < 6
  if [[ "$minor" -eq 26 ]] && [[ "${patch:-0}" -lt 6 ]]; then
    return 0
  fi
  # 1.27.0-rc.1 and rc.2 are vulnerable; rc.3+ is patched
  if [[ "$minor" -eq 27 ]]; then
    if echo "$1" | grep -qE 'rc\.?[12]$'; then
      return 0
    fi
    if [[ "${patch:-0}" -eq 0 ]] && ! echo "$1" | grep -qE 'rc'; then
      # 1.27.0 release (if it exists) should be patched
      return 1
    fi
  fi
  # Older branches (< 1.25) are vulnerable if they have encoding/xml
  if [[ "$minor" -lt 25 ]]; then
    return 0
  fi
  return 1
}

for dir in ${SEARCH_DIRS[@]}; do
  [ -d "$dir" ] || continue
  while IFS= read -r -d '' binary; do
    ver_line=$(go version "$binary" 2>/dev/null || true)
    if [[ -z "$ver_line" ]] || [[ "$ver_line" == *"not a Go executable"* ]]; then
      continue
    fi
    go_ver=$(echo "$ver_line" | grep -oP 'go[0-9]+\.[0-9]+\.[0-9]+[^\s]*' | head -1)
    if [[ -z "$go_ver" ]]; then
      continue
    fi
    CHECKED=$((CHECKED + 1))
    # Check if binary imports encoding/xml
    uses_xml=$(go version -m "$binary" 2>/dev/null | grep -c 'encoding/xml' || true)
    if [[ "$uses_xml" -gt 0 ]] && is_vulnerable_version "$go_ver"; then
      echo "[VULNERABLE] $binary (compiled with $go_ver, imports encoding/xml)"
      VULNERABLE=1
    elif is_vulnerable_version "$go_ver"; then
      echo "[INFO] $binary (compiled with $go_ver, does NOT import encoding/xml — not directly affected)"
    else
      echo "[PATCHED] $binary (compiled with $go_ver)"
    fi
  done < <(find "$dir" -type f -executable -print0 2>/dev/null)
done

if [[ "$CHECKED" -eq 0 ]]; then
  echo "UNKNOWN — no Go binaries found in specified directories."
  exit 2
elif [[ "$VULNERABLE" -eq 1 ]]; then
  echo "VULNERABLE — one or more Go binaries compiled with affected toolchain and importing encoding/xml."
  exit 1
else
  echo "PATCHED — all detected Go binaries use a fixed toolchain version."
  exit 0
fi

1. Go Vulnerability Database — GO-2026-6088
2. golang/go Issue #80481 — DecodeElement bypasses recursion-depth guard
3. NVD — CVE-2026-56859
4. Red Hat Security Advisory — CVE-2026-56859
5. KrakenD Security Advisory — CVE-2026-56859
6. OpenCVE — CVE-2026-56859
7. Go CL 803320 — Fix patch