Skip to content
Fencer Vulns
high 7.5

CVE-2026-56852 json

Infinite loop on invalid input in golang.org/x/text

published 2026-07-14 3 mo ago modified 2026-10-24 15 d ago also GO-2026-5970 , EUVD-2026-46384

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Patch / fix

  • go golang.org/x/text 0.39.0
  • golang.org/x/text golang.org/x/text/unicode/norm 0.39.0
  • golang-golang-x-text Debian 14 0.40.0-1

debian advisories DEBIAN-CVE-2026-56852

  • podman RHEL 10.2 7:5.8.2-9.el10_2
  • podman-tests RHEL 10.2 7:5.8.2-9.el10_2
  • podman-docker RHEL 10.2 7:5.8.2-9.el10_2
  • podman-remote RHEL 10.2 7:5.8.2-9.el10_2
  • rhc RHEL 8 1:0.2.5-11.el8_10
  • flightctl edge manager 1.1 1.1.4-1.el10em
  • flightctl edge manager 1.1 1.1.4-1.el9em
  • flightctl-cli edge manager 1.1 1.1.4-1.el10em

red hat advisories RHSA-2026:70201RHSA-2026:69258RHSA-2026:68334RHSA-2026:68335RHSA-2026:54549RHSA-2026:54364

  • aws-iam-authenticator SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +1 more 0.7.22-150000.1.23.1
  • helm Linux Micro 6.1 4.3.0-slfo.1.1_1.1
  • golang-github-prometheus-prometheus SLE Module for Package Hub 15 SP7 3.13.2-150100.4.40.2
  • system-user-grafana SLE Module for Package Hub 15 SP7 1.0.0-150200.5.8.1
  • grafana SLE Module for Package Hub 15 SP7 12.4.10-150200.3.94.3
  • cosign SLES for SAP applications 16.0, SLES 16.0 3.1.3-160000.1.1
  • grafana Multi Linux Manager Tools SLE-15 12.4.10-150002.4.27.1
  • mgr-push Multi Linux Manager Tools SLE-15 5.2.5-150002.3.12.1

suse advisories SUSE-SU-2026:4891-1SUSE-SU-2026:24282-1SUSE-SU-2026:4606-1SUSE-SU-2026:4600-1SUSE-SU-2026:24213-1SUSE-SU-2026:4585-1

  • flannel openSUSE Tumbleweed 0.28.10-1.1
  • grafana openSUSE Leap 16.0 12.4.10-bp160.1.1
  • cosign openSUSE Leap 16.0 3.1.3-160000.1.1
  • alloy openSUSE Leap 16.0 1.19.2-160000.1.1
  • velociraptor openSUSE Tumbleweed 0.76.7.0.git145.b60ef1146-1.1
  • helm openSUSE Leap 16.0 4.3.0-160000.1.1
  • cosign openSUSE Tumbleweed 3.1.3-1.1
  • google-osconfig-agent openSUSE Leap 16.0 20260911.00-160000.1.1

opensuse advisories openSUSE-SU-2026:12270-1openSUSE-SU-2026:22125-1openSUSE-SU-2026:22064-1openSUSE-SU-2026:22032-1openSUSE-SU-2026:12070-1openSUSE-SU-2026:21983-1

  • podman AlmaLinux 10 7:5.8.2-9.el10_2.alma.1
  • podman-tests AlmaLinux 10 7:5.8.2-9.el10_2.alma.1
  • podman-docker AlmaLinux 10 7:5.8.2-9.el10_2.alma.1
  • podman-remote AlmaLinux 10 7:5.8.2-9.el10_2.alma.1

almalinux advisories ALSA-2026:70201

  • podman Rocky Linux 10 7:5.8.2-9.el10_2

rocky linux advisories RLSA-2026:70201

  • application-gateway-kubernetes-ingress Azure Linux 3.0 1.7.7-6
  • azcopy Azure Linux 3.0 10.25.1-7
  • azurelinux-image-tools Azure Linux 3.0 1.5.0-2
  • cert-manager Azure Linux 3.0 1.12.15-11
  • cf-cli Azure Linux 3.0 8.7.11-8
  • cloud-provider-kubevirt Azure Linux 3.0 0.5.1-6
  • containerd2 Azure Linux 3.0 2.2.4-6
  • containerized-data-importer Azure Linux 3.0 1.62.0-7

azure linux advisories AZL-93105AZL-93108AZL-93111AZL-93141AZL-93144AZL-93147

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-56852 updated cvss 7.5

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

  • Red Hat AWS Load Balancer Operator albo/aws-load-balancer-rhel9-operator Red Hat Compliance Operator compliance/openshift-compliance-rhel8-operator Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9-operator Red Hat Deployment Validation Operator dvo/deployment-validation-rhel8-operator Red Hat ExternalDNS Operator edo/external-dns-rhel8 Red Hat Fence Agents Remediation Operator workload-availability/fence-agents-remediation-rhel8-operator, workload-availability/fence-agents-remediation-rhel9-operator
    +9 more products
    Red Hat File Integrity Operator compliance/openshift-file-integrity-rhel8-operator Red Hat Job Set 1 job-set/jobset-rhel9 Red Hat Job Set Tech Preview job-set/jobset-rhel9 Red Hat Kernel Module Management Operator for Red Hat Openshift kmm/kernel-module-management-worker-rhel9 Red Hat Kube Descheduler Operator kube-descheduler-operator/descheduler-rhel9 Red Hat Leader Worker Set leader-worker-set/lws-rhel9 Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/cluster-logging-rhel9-operator Red Hat Machine Deletion Remediation Operator workload-availability/machine-deletion-remediation-rhel8-operator, workload-availability/machine-deletion-remediation-rhel9-operator
    affected: workaround, no fix available
  • Red Hat MCP Server for Red Hat OpenShift openshift-mcp-beta/openshift-mcp-server-rhel9, openshift-mcp-tech-preview/openshift-mcp-server-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/work-rhel9, multicluster-engine/placement-rhel9, multicluster-engine/registration-rhel9, multicluster-engine/addon-manager-rhel9, multicluster-engine/cluster-proxy-rhel9, multicluster-engine/capoa-bootstrap-rhel9, +20 more Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel9, workload-availability/node-healthcheck-rhel8-operator, workload-availability/node-healthcheck-rhel9-operator, node-healthcheck-operator-tech-preview/node-healthcheck-operator-rhel8, node-healthcheck-operator-tech-preview/node-healthcheck-rhel8-operator Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel9-operator Red Hat OpenShift Pipelines openshift-pipelines-client, openshift-pipelines/pipelines-opc-rhel9 Red Hat OpenShift Run Once Duration Override Operator run-once-duration-override-operator/run-once-duration-override-rhel9 Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator
    +4 more products
    Red Hat OpenShift Serverless kn-workflow-plugin Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9 Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9 Red Hat Power monitoring for Red Hat OpenShift openshift-power-monitoring/kepler-rhel9
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/subctl-rhel9, rhacm2/volsync-rhel9, rhacm2.13/thanos-rhel9, rhacm2/submariner-addon-rhel9, rhacm2/cluster-backup-rhel9-operator, multicluster-engine/cluster-permission-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-main-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat Connectivity Link 1 rhcl-1/coredns-rhel9 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 7 rhc Red Hat OpenShift Cluster Manager CLI ocm-cli-clients/ocm-cli-rhel9 Red Hat OpenShift Container Platform 4 cri-o, openshift4/ose-cli-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 5 cri-o, openshift5/ose-cli-rhel9, openshift5/ose-thanos-rhel9, openshift5/ose-kube-rbac-proxy-rhel9, openshift5/ose-prometheus-alertmanager-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift for Windows Containers openshift4-wincw/windows-machine-config-rhel9-operator
    affected: workaround, no fix available
show 2 more
  • Red Hat OpenShift GitOps openshift-gitops-1/dex-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift on AWS rosa Red Hat OpenShift Update Service openshift-update-service/openshift-update-service-rhel8-operator Red Hat Trusted Artifact Signer rhtas/ec-rhel9
    affected: workaround, no fix available

6 more affected, 7 more under investigation, 75 more fixed, 102 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go golang.org/x/text
<0.39.0
0.39.0

Affected products

  • golang.org/x/text golang.org/x/text/unicode/norm

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.