CVE-2026-56859 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Description

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
encoding/xml 1.27	premières → < 1.27.0-rc.3	1.27.0-rc.3
encoding/xml 1.26	1.26.0-0 → < 1.26.6	1.26.6
encoding/xml 1.25	premières → < 1.25.13	1.25.13

Autres CVE de encoding/xml

Les 3 CVE de encoding/xml →

CVE-2022-30633 Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a… 7.5 Élevée CVE-2022-28131 Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a… Non notée