{"id":"CVE-2026-56851","kind":"vulnerability","aliases":["CVE-2026-56851","GO-2026-6629"],"related":[],"title":"Panic parsing crafted input in x/text/secure/precis in golang.org/x/text","description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","summary":"A Go library, golang.org/x/text, panics when its precis (Nickname profile) code transforms crafted input into a short destination buffer, due to an out-of-bounds slice. A remote party who can get such input into a service that uses this code can crash the process, which is a denial of service.","severity":"high","cvss":7.5,"epss":0.00335,"exploited":false,"exploited_at":null,"products":[{"name":"golang.org/x/text","fixed":["0.41.0"],"affected":"< 0.41.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","golang.org/x/text","package","services-parsing-user-input"],"not_affected_if":["does-not-import-secure/precis","nickname-profile-unused"],"how_to_check":"Run `go list -m golang.org/x/text` in each Go module and check whether the version is below 0.41.0.\nSearch for imports of golang.org/x/text/secure/precis to see whether the affected code path is used at all.","fix":"Upgrade golang.org/x/text to 0.41.0 or later with `go get golang.org/x/text@v0.41.0` and rebuild.","status":"open","published_at":"2026-10-07T14:09:43+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:13+00:00","updated_at":"2026-10-23T19:56:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:56:13Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade golang.org/x/text to 0.41.0 or later with `go get golang.org/x/text@v0.41.0` and rebuild.\nunknown","summary":"A Go library, golang.org/x/text, panics when its precis (Nickname profile) code transforms crafted input into a short destination buffer, due to an out-of-bounds slice. A remote party who can get such input into a service that uses this code can crash the process, which is a denial of service.","category":"package","who_cares":["go","golang.org/x/text","services-parsing-user-input"],"confidence":0.7,"analyst_note":"","how_to_check":"Run `go list -m golang.org/x/text` in each Go module and check whether the version is below 0.41.0.\nSearch for imports of golang.org/x/text/secure/precis to see whether the affected code path is used at all.\nunknown","needs_analyst":false,"not_affected_if":["does-not-import-secure/precis","nickname-profile-unused"],"severity_if_unknown":"high"},"cost_usd":0.000379,"input_tokens":2053,"output_tokens":348,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,18A '-56851':13A,19A '-6629':16A '/x/text':10A,22A,26B '/x/text,':38B 'bound':60B,97C 'buffer':53B,108C 'code':45B,76B 'craft':3A,47B,102C 'crash':78B 'cve':11A,17A 'denial':84B 'destin':52B,107C 'due':54B 'error':99C 'get':67B 'go':14A,23B,34B 'golang.org':9A,21A,25B,37B 'golang.org/x/text':8A,20A,24B 'golang.org/x/text,':36B 'input':4A,32B,48B,69B,103C 'librari':35B 'nicknam':43B,88C 'out-of-bound':57B,94C 'packag':27B 'panic':1A,39B,91C 'pars':2A,30B 'parti':64B 'preci':42B 'process':80B 'profil':44B,89C 'remot':63B 'servic':29B,72B,86B 'services-parsing-user-input':28B 'short':51B,106C 'slice':61B,98C 'transform':46B,101C 'use':74B 'user':31B 'x/text/secure/precis':6A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T14:09:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6629","url":"https://pkg.go.dev/vuln/GO-2026-6629","severity":null,"published_at":"2026-10-07T14:09:43+00:00","modified_at":"2026-10-07T14:09:43+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-56851","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56851","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-56851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","severity":null,"published_at":"2026-10-07T18:17:20+00:00","modified_at":"2026-10-08T21:35:53+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}