Live › vulnerability › CVE-2026-56851
Go to dashboardA Go library, golang.org/x/text, panics when its precis (Nickname profile) code transforms crafted input into a short destination buffer, due to an out-of-bounds slice. A remote party who can get such input into a service that uses this code can crash the process, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| golang.org/x/text | go | < 0.41.0 | 0.41.0 |
Run go list -m golang.org/x/text in each Go module and check whether the version is below 0.41.0.
Search for imports of golang.org/x/text/secure/precis to see whether the affected code path is used at all.
Upgrade golang.org/x/text to 0.41.0 or later with go get golang.org/x/[email protected] and rebuild.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.
This page as .md · .json · in your agent: get_signal("CVE-2026-56851")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.