Go encoding/xml CVE-2026-56859

Upgrade the Go toolchain to version 1.25.13, 1.26.6, or 1.27.0-rc.3 or later, depending on the release branch in use; the fix is confirmed available per the vendor advisory at https://pkg.go.dev/vuln/GO-2026-6088 and the change is tracked at https://go.dev/cl/803320. Applications must be recompiled against the patched Go toolchain - simply updating the toolchain without rebuilding binaries does not remediate deployed services. Where immediate patching is not feasible, a concrete compensating control is to validate and reject XML input that exceeds a safe nesting depth before passing it to DecodeElement; this adds latency to the parsing path but removes the exploit vector without requiring a toolchain upgrade. Alternatively, refactoring affected code to use xml.NewDecoder with Token-level iteration rather than DecodeElement avoids the vulnerable code path entirely, though this requires application-level changes. Restricting access to XML-consuming endpoints via network controls or authentication reduces exposure for internal services.