CVE-2026-56852

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

No affected versions have been published.

Timeline

Published
Jul 21, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-568537.5When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 cCVE-2026-568547.5The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback andCVE-2026-568557.5Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. NoCVE-2026-568579.8On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directoryCVE-2026-568586.1Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentiCVE-2026-568597.5Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.CVE-2026-56868.8A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/CVE-2026-568605.9Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each stCVE-2026-568627.5Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or notCVE-2026-568647.5A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coorCVE-2026-568658.4A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check anCVE-2026-568667.5When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without fra
CVE-2026-56852: High severity, CVSS 7.5 | Vulnix