---
id: CVE-2026-56851
title: >-
  The Nickname profile can panic with an out-of-bounds slice error when
  transforming crafted input into a short destination buffer.
summary: >-
  The Nickname profile can panic with an out-of-bounds slice error when
  transforming crafted input into a short destination buffer.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-787
vendor: golang.org/x/text
product: golang.org/x/text/secure/precis
affected:
  - golang.org/x/text/secure/precis < 0.41.0
patched:
  - golang.org/x/text 0.41.0
published: '2026-10-07'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:35:53.890'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56851'
references:
  - url: 'https://go.dev/cl/793360'
    label: security@golang.org
  - url: 'https://go.dev/issue/80112'
    label: security@golang.org
  - url: 'https://pkg.go.dev/vuln/GO-2026-6629'
    label: security@golang.org
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56851.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-56851'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2547607'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-56851'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56851'
  - url: 'https://access.redhat.com/errata/RHSA-2026:70670'
  - url: 'https://access.redhat.com/errata/RHSA-2026:75151'
  - url: 'https://access.redhat.com/errata/RHSA-2026:73401'
  - url: 'https://access.redhat.com/errata/RHSA-2026:70537'
  - url: 'https://access.redhat.com/errata/RHSA-2026:76606'
  - url: 'https://access.redhat.com/errata/RHSA-2026:62391'
  - url: 'https://access.redhat.com/errata/RHSA-2026:70700'
  - url: 'https://access.redhat.com/errata/RHSA-2026:76677'
  - url: 'https://access.redhat.com/errata/RHSA-2026:76448'
  - url: 'https://access.redhat.com/errata/RHSA-2026:76430'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68717'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68729'
  - url: 'https://access.redhat.com/errata/RHSA-2026:70031'
  - url: 'https://access.redhat.com/errata/RHSA-2026:72570'
  - url: 'https://access.redhat.com/errata/RHSA-2026:72496'
  - url: 'https://access.redhat.com/errata/RHSA-2026:74536'
  - url: 'https://access.redhat.com/errata/RHSA-2026:73524'
  - url: 'https://access.redhat.com/errata/RHSA-2026:73523'
  - url: 'https://access.redhat.com/errata/RHSA-2026:73522'
  - url: 'https://access.redhat.com/errata/RHSA-2026:74948'
  - url: 'https://access.redhat.com/errata/RHSA-2026:74861'
  - url: 'https://access.redhat.com/errata/RHSA-2026:72750'
tags:
  - nvd
  - cve.org
  - osv
  - go
  - csaf
  - vex
  - red-hat
aliases:
  - GO-2026-6629
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-08T13:48:57.351617Z'
ingestedAt: '2026-10-07T18:42:20.892Z'
epss: 0.00466
epssPercentile: 0.40127
---

## Overview

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-56851)

Affected packages:

- `golang.org/x/text < 0.41.0`

Patched in:

- `golang.org/x/text 0.41.0`

Source: https://osv.dev/vulnerability/GO-2026-6629

## Vendor advisories

- **RHSA-2026:70670** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70670)
- **RHSA-2026:75151** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:75151)
- **RHSA-2026:73401** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:73401)
- **RHSA-2026:70537** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70537)
- **RHSA-2026:76606** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76606)
- **RHSA-2026:62391** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62391)
- **RHSA-2026:70700** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:70700)
- **RHSA-2026:76677** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76677)
- **RHSA-2026:76448** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76448)
- **RHSA-2026:76430** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76430)
- **RHSA-2026:68717** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68717)
- **Red Hat VEX** · Important · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-10-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56851.json)