Add recursion depth guard during decode in encoding/xml

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-56859 · Microsoft / collected KEV context

EUVD-2026-58509

GHSA-76p8-fhrm-vpc7

GO-2026-6088

BIT-golang-2026-56859

cve-program · CVE-2026-56859

• https://go.dev/issue/80481
• https://go.dev/cl/803320
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6088

euvd · EUVD-2026-58509

• https://go.dev/issue/80481
• https://go.dev/cl/803320
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6088

nvd · CVE-2026-56859

• https://go.dev/cl/803320
• https://go.dev/issue/80481
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6088

osv · GO-2026-6088

• https://go.dev/issue/80481
• https://go.dev/cl/803320
• https://groups.google.com/g/golang-announce/c/94pEornpRlI

• Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. · Advisory content revised · 7 Nov 2026
• Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. · Advisory content revised · 5 Nov 2026
• Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. · Advisory content revised · 1 Nov 2026