CVE-2026-56852High· 7.5▾ MidnightPoC availableInfinite loop on invalid input in golang.org/x/text
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.4%
0.4% → 0.5%
1 GitHub repo
— → 7.5
none → high
7.5 → —
high → none
— → 7.5
none → high
Last analysed / modified upstream
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
golang.org/x/text < 0.39.0Upgrade to a patched release:
golang.org/x/text 0.39.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42502Medium· 6.1Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
CVE-2026-100354High· 7.5kin-openapi is a Go project for handling OpenAPI files
CVE-2026-46385High· 7.5iskorotkov/avro is a fast Go Avro codec
CVE-2026-112390High· 7.5Pillow: Infinite loop in MIC n_frames when the embedded TIFF
CVE-2021-33194High· 7.5golang: x/net/html: infinite loop in ParseFragment (CVE-2021-33194)
CVE-2022-32149High· 7.5golang.org/x/text/language Denial of service via crafted Accept-Language header