CVE-2026-56859 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Description

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Affected products and versions

Product	Affected versions	Fixed in
encoding/xml 1.27	earliest → < 1.27.0-rc.3	1.27.0-rc.3
encoding/xml 1.26	1.26.0-0 → < 1.26.6	1.26.6
encoding/xml 1.25	earliest → < 1.25.13	1.25.13

Other CVEs of encoding/xml

The 3 CVEs of encoding/xml →

CVE-2022-30633 Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a… 7.5 High CVE-2022-28131 Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a… Not rated