{"id":"CVE-2026-56852","sourceIdentifier":"security@golang.org","published":"2026-07-21T20:17:02.867","lastModified":"2026-10-24T19:10:00.127","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes."},{"lang":"es","value":"Un norm.Iter puede entrar en un bucle infinito al procesar la entrada que contiene bytes UTF-8 no válidos."}],"affected":[{"source":"security@golang.org","affectedData":[{"vendor":"golang.org/x/text","product":"golang.org/x/text/unicode/norm","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"golang.org/x/text/unicode/norm","programRoutines":[{"name":"nextComposed"},{"name":"Form.Append"},{"name":"Form.AppendString"},{"name":"Form.Bytes"},{"name":"Form.FirstBoundary"},{"name":"Form.FirstBoundaryInString"},{"name":"Form.IsNormal"},{"name":"Form.IsNormalString"},{"name":"Form.LastBoundary"},{"name":"Form.NextBoundary"},{"name":"Form.NextBoundaryInString"},{"name":"Form.Properties"},{"name":"Form.PropertiesString"},{"name":"Form.QuickSpan"},{"name":"Form.QuickSpanString"},{"name":"Form.Span"},{"name":"Form.SpanString"},{"name":"Form.String"},{"name":"Form.Transform"},{"name":"Iter.Init"},{"name":"Iter.InitString"},{"name":"Iter.Next"},{"name":"Iter.Seek"},{"name":"normReader.Read"},{"name":"normWriter.Write"}],"versions":[{"version":"0","lessThan":"0.39.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-23T13:26:14.918983Z","id":"CVE-2026-56852","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"references":[{"url":"https://go.dev/cl/794100","source":"security@golang.org"},{"url":"https://go.dev/issue/80142","source":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2026-5970","source":"security@golang.org"}]}