{"id":"CVE-2026-56851","title":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","summary":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-787"],"vendor":"golang.org/x/text","product":"golang.org/x/text/secure/precis","affected":["golang.org/x/text/secure/precis < 0.41.0"],"patched":["golang.org/x/text 0.41.0"],"published":"2026-10-07","updated":"2026-10-08","sourceUpdated":"2026-10-08T21:35:53.890","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","references":[{"url":"https://go.dev/cl/793360","label":"security@golang.org"},{"url":"https://go.dev/issue/80112","label":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2026-6629","label":"security@golang.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56851.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-56851"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547607"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56851"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851"},{"url":"https://access.redhat.com/errata/RHSA-2026:70670"},{"url":"https://access.redhat.com/errata/RHSA-2026:75151"},{"url":"https://access.redhat.com/errata/RHSA-2026:73401"},{"url":"https://access.redhat.com/errata/RHSA-2026:70537"},{"url":"https://access.redhat.com/errata/RHSA-2026:76606"},{"url":"https://access.redhat.com/errata/RHSA-2026:62391"},{"url":"https://access.redhat.com/errata/RHSA-2026:70700"},{"url":"https://access.redhat.com/errata/RHSA-2026:76677"},{"url":"https://access.redhat.com/errata/RHSA-2026:76448"},{"url":"https://access.redhat.com/errata/RHSA-2026:76430"},{"url":"https://access.redhat.com/errata/RHSA-2026:68717"},{"url":"https://access.redhat.com/errata/RHSA-2026:68729"},{"url":"https://access.redhat.com/errata/RHSA-2026:70031"},{"url":"https://access.redhat.com/errata/RHSA-2026:72570"},{"url":"https://access.redhat.com/errata/RHSA-2026:72496"},{"url":"https://access.redhat.com/errata/RHSA-2026:74536"},{"url":"https://access.redhat.com/errata/RHSA-2026:73524"},{"url":"https://access.redhat.com/errata/RHSA-2026:73523"},{"url":"https://access.redhat.com/errata/RHSA-2026:73522"},{"url":"https://access.redhat.com/errata/RHSA-2026:74948"},{"url":"https://access.redhat.com/errata/RHSA-2026:74861"},{"url":"https://access.redhat.com/errata/RHSA-2026:72750"}],"tags":["nvd","cve.org","osv","go","csaf","vex","red-hat"],"aliases":["GO-2026-6629"],"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-08T13:48:57.351617Z"},"ingestedAt":"2026-10-07T18:42:20.892Z","epss":0.00466,"epssPercentile":0.40127,"slug":"CVE-2026-56851","body":"## Overview\n\nThe Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-56851)\n\nAffected packages:\n\n- `golang.org/x/text < 0.41.0`\n\nPatched in:\n\n- `golang.org/x/text 0.41.0`\n\nSource: https://osv.dev/vulnerability/GO-2026-6629\n\n## Vendor advisories\n\n- **RHSA-2026:70670** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70670)\n- **RHSA-2026:75151** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:75151)\n- **RHSA-2026:73401** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:73401)\n- **RHSA-2026:70537** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70537)\n- **RHSA-2026:76606** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76606)\n- **RHSA-2026:62391** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62391)\n- **RHSA-2026:70700** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70700)\n- **RHSA-2026:76677** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76677)\n- **RHSA-2026:76448** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76448)\n- **RHSA-2026:76430** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76430)\n- **RHSA-2026:68717** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68717)\n- **Red Hat VEX** · Important · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-10-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56851.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":218053,"id":"CVE-2026-56851","ts":1791470901310,"field":"cvss","old":null,"new":"7.5"},{"seq":218052,"id":"CVE-2026-56851","ts":1791470901310,"field":"severity","old":"none","new":"high"}]}