GO-2026-5970 CVE-2026-56852
Infinite loop on invalid input in golang.org/x/text
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.47%
- Chance of exploitation in the next 30 days. Higher than 41.06% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
0.39.0- Upgrade golang.org/x/text to this version or later
Description
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| golang.org/x/text | < 0.39.0 |
0.39.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
golang.org/x/text Go → 0.39.0
- go
go get golang.org/x/text@v0.39.0 && go mod tidy
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Fixes and patches
Issue reports
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GO-2026-6629 Panic parsing crafted input in x/text/secure/precis in golang.org/x/text | High | Also affects golang.org/x/text |
| GHSA-69ch-w2m2-3vjp golang.org/x/text/language Denial of service via crafted Accept-Language header | High | Also affects golang.org/x/text |
| GHSA-ppp9-7jff-5vj2 golang.org/x/text/language Out-of-bounds Read vulnerability | High | Also affects golang.org/x/text |
| GHSA-5rcv-m4m3-hfh7 golang.org/x/text Infinite loop | High | Also affects golang.org/x/text |
| GHSA-5849-834g-hvw5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search | High | Same weakness, CWE-835 |
| GHSA-mfr5-77xh-9j7h pypdf has possible infinite loop when cloning dictionaries | High | Same weakness, CWE-835 |
| GHSA-h6cr-wjv9-3cpp Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) | Low | Same weakness, CWE-835 |
| GHSA-fw5c-8223-6h42 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) | Medium | Same weakness, CWE-835 |
Credits: Viky Choi ("vikychoi" on GitHub)
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor