CVE-2026-56852
CVE-2026-56852 · Infinite loop on invalid input in golang.org/x/text
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
CVSS 7.5 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
golang.org/x/text/unicode/norm
- Versions
- ≥ 0, < 0.39.0: Affected (semver)
Update to 0.39.0
golang-golang-x-text Debian:12
- Versions
- 0.10.0-1
- 0.11.0-1
- 0.12.0-1
- 0.13.0-1
- 0.14.0-1
- 0.14.0-2
- 0.15.0-1
- 0.16.0-1
- 0.16.0-1~bpo12+1
- 0.22.0-1
- 0.29.0-1
- 0.29.0-2
- 0.31.0-1
- 0.32.0-1
- 0.35.0-1
- 0.36.0-1
- 0.36.0-1~bpo13+1
- 0.40.0-1
- 0.41.0-1
- 0.43.0-1
- 0.7.0-1
- 0.9.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-text Debian:13
- Versions
- 0.22.0-1
- 0.29.0-1
- 0.29.0-2
- 0.31.0-1
- 0.32.0-1
- 0.35.0-1
- 0.36.0-1
- 0.36.0-1~bpo13+1
- 0.40.0-1
- 0.41.0-1
- 0.43.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-text Debian:14
- Versions
- 0.22.0-1
- 0.29.0-1
- 0.29.0-2
- 0.31.0-1
- 0.32.0-1
- 0.35.0-1
- 0.36.0-1
- 0.36.0-1~bpo13+1
- Affected ranges
- ECOSYSTEM: < 0.40.0-1
Update to 0.40.0-1
golang-golang-x-text Ubuntu:20.04:LTS
- Versions
- 0.3.2-3
- 0.3.2-4
- 0.3.2-4ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-text Ubuntu:22.04:LTS
- Versions
- 0.3.6-1
- 0.3.7-1
- 0.3.7-1ubuntu0.20.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-text Ubuntu:24.04:LTS
- Versions
- 0.9.0-1
- 0.13.0-1
- 0.14.0-1
- 0.14.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-text Ubuntu:26.10
- Versions
- 0.31.0-1
- 0.36.0-1
- 0.40.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-text Ubuntu:26.04:LTS
- Versions
- 0.22.0-1
- 0.31.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published