golang.org/x/text CVE-2026-56851

Exploitability requires that the target application actually invoke the golang.org/x/text/secure/precis Nickname profile to transform/enforce attacker-controlled input (e.g., usernames or nicknames) into a short/undersized destination buffer; the panic occurs only on this specific code path. Applications that merely vendor golang.org/x/text without using the precis Nickname profile on untrusted input are not affected. Limiting factors: impact is denial of service only (a Go panic), there is no confidentiality or integrity impact, and the affected versions are golang.org/x/text/secure/precis < 0.41.0 (fixed in 0.41.0). No authentication or user interaction is required where the vulnerable path is reachable (PR:N/UI:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with impact confined to availability only - consistent with CWE-787 manifesting in Go as a runtime panic (out-of-bounds slice) rather than exploitable memory corruption. This is a denial-of-service issue, NOT a code-execution or data-disclosure one, so the 'HIGH' severity reflects crash/availability risk only. Exploitation status: no public exploit identified at time of analysis - the input provides no KEV listing and no POC flag. EPSS is not provided, so probabilistic exploitation likelihood cannot be stated. The signals are internally consistent (network DoS, no confidentiality/integrity impact) with no CVSS-vs-description conflict. Real-world priority is moderate and strongly dependent on reachability: it is a real risk only for services that pass untrusted input through the precis Nickname profile; absent that code path, the library's mere presence is not exploitable. Note the tags 'Buffer Overflow'/'Memory Corruption' overstate the technical nature - in Go this is a bounds-checked panic (abort), not attacker-controlled memory corruption.

An attacker sends a crafted string (e.g., a username/nickname field) to a network service that normalizes it using golang.org/x/text/secure/precis Nickname profile into an undersized destination buffer. The transformation triggers an out-of-bounds slice panic, crashing the goroutine or process and causing a denial of service. No public exploit code has been identified, and the attack is unauthenticated and low-complexity per the CVSS vector.