What is the CVSS score of CVE-2026-56852?

CVE-2026-56852 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Golang Org X Text Unicode Norm are affected by CVE-2026-56852?

golang.org/x/text versions before 0.39.0 contain a denial-of-service vulnerability affecting Go applications that normalize untrusted Unicode input.. A patch is available.

Is there a public PoC exploit available for CVE-2026-56852?

Yes, a public proof-of-concept exploit is available for CVE-2026-56852. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-56852?

Within 24 hours, audit all Go infrastructure to identify services using golang.org/x/text and document current package versions in production. Within 7 days, update golang.org/x/text to version 0.39.0 or later in development and staging environments, execute full regression testing on Unicode normalization functionality, and validate performance under load. Within 30 days, deploy patched version to production in a phased manner and implement monitoring for Unicode normalization errors to detect exploitation attempts.

Golang Org X Text Unicode Norm CVE-2026-56852

EUVD-2026-46384 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-07-21 Go

GHSA-jpjm-c3r5-q96r

Denial Of Service Red Hat Suse Golang Org X Text Unicode Norm

7.5

CVSS 3.1 · Vendor: Go

Severity by source

Vendor (Go) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (Go).

CVSS VectorVendor: Go

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 14:30 vuln.today

CVSS changed

Jul 23, 2026 - 14:23 NVD

7.5 (HIGH)

Patch available

Jul 21, 2026 - 21:18 EUVD

CVE Published

Jul 21, 2026 - 19:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 21, 2026 - 19:18 cve.org

HIGH 7.5

DescriptionCVE.org

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

AnalysisAI

Denial of service in the golang.org/x/text/unicode/norm package (versions before 0.39.0) allows remote attackers to cause an unrecoverable infinite loop by supplying input containing invalid UTF-8 bytes to a norm.Iter. Any Go service that Unicode-normalizes untrusted input using this widely-used supplementary library can be hung with a single malformed request, consuming CPU until the process is killed. No public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile), but the network-reachable, no-authentication, no-interaction profile makes it broadly triggerable.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all

CVE-2024-20353 HIGH POC

8.6

CVE-2020-13935 HIGH POC

7.5

CVE-2017-16944 HIGH POC

7.5

CVE-2022-0778 HIGH POC

7.5

CVE-2024-43366 CRITICAL POC

9.1

CVE-2026-25533 HIGH POC

8.8

CVE-2018-8002 HIGH POC

8.8

CVE-2026-66730 HIGH POC

8.7

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
Container suse/kubectl:1.33.11-2.70.2 Container suse/kubectl:1.35.4-1.70.2	Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest	Affected
SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed

CVE-2026-56852 vulnerability details – vuln.today

Back

Golang Org X Text Unicode Norm CVE-2026-56852

Severity by source

CVSS VectorVendor: Go

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code