GO-2026-5970 - Go Packages
Vulnerability Report: GO-2026-5970
CVE-2026-56852
Affects:
golang.org/x/text
Published: Jul 14, 2026
Modified: Aug 10, 2026
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
Affected Packages
Path
Go Versions
Symbols
golang.org/x/text/unicode/norm
before v0.39.0
22 affected symbols<br>Form.Append<br>Form.AppendString<br>Form.Bytes<br>Form.FirstBoundary<br>Form.FirstBoundaryInString<br>Form.IsNormal<br>Form.IsNormalString<br>Form.LastBoundary<br>Form.NextBoundary<br>Form.NextBoundaryInString<br>Form.Properties<br>Form.PropertiesString<br>Form.QuickSpan<br>Form.QuickSpanString<br>Form.Span<br>Form.SpanString<br>Form.String<br>Form.Transform<br>Iter.Init<br>Iter.InitString<br>Iter.Next<br>Iter.Seek
Aliases
CVE-2026-56852
References
https://go.dev/issue/80142<br>https://go.dev/cl/794100
https://vuln.go.dev/ID/GO-2026-5970.json
Credits
Viky Choi ("vikychoi" on GitHub)
Feedback
See anything missing or incorrect?
Suggest an edit to this report.
Jump to
Close
Keyboard shortcuts
? : This menu
/ : Search site
f or F : Jump to
y or Y<br>: Canonical URL
Close
go.dev uses cookies from Google to deliver and enhance the quality of its services and to<br>analyze traffic. Learn more.
Okay