CVE-2026-56851: golang.org/x/text golang.org/x/text/secure/precis Out-of-bounds Write

CVSS: 7.5v3.1HighDeferred

AliasesUBUNTU-CVE-2026-56851DEBIAN-CVE-2026-56851CGA-22vv-cxrv-5xrh+1505 more

Published 07-10-2026Last modified 08-10-2026

Vulnerability summary

CVE-2026-56851 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in golang.org/x/text golang.org/x/text/secure/precis. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.4% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.34%

0%100%

Low · Change unavailable

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 7

CVE-2026-102422 CVE-2026-61801 CVE-2026-63209 CVE-2026-76835 CVE-2026-77411 CVE-2026-81871+7 more

Timeline

07-10-2026
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.5

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

Change unavailable

08-10-202620-10-2026

EPSS score

0.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Chainguard200 products

addon-resizerAll versions (No fix recorded)
addon-resizer-fipsAll versions (No fix recorded)
amazon-eks-ami-fipsAll versions (No fix recorded)
apache-exporterAll versions (No fix recorded)
apm-server-fips-9.2All versions (No fix recorded)

argo-cd-3.1All versions (No fix recorded)
argo-cd-3.1-compatAll versions (No fix recorded)
athenz-cert-manager-issuerAll versions (No fix recorded)
athenz-cert-manager-issuer-fipsAll versions (No fix recorded)
auditbeat-fips-9.2All versions (No fix recorded)
avmfixAll versions (No fix recorded)
avmfix-fipsAll versions (No fix recorded)
aws-application-networking-k8sAll versions (No fix recorded)
aws-application-networking-k8s-fipsAll versions (No fix recorded)
aws-ebs-csi-driver-1.58All versions (No fix recorded)
aws-ebs-csi-driver-1.59All versions (No fix recorded)
aws-ebs-csi-driver-1.60All versions (No fix recorded)
aws-ebs-csi-driver-1.61All versions (No fix recorded)
aws-ebs-csi-driver-1.62All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.59All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.60All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.61All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.63All versions (No fix recorded)
aws-eks-pod-identity-agentAll versions (No fix recorded)
aws-eks-pod-identity-agent-fipsAll versions (No fix recorded)
aws-iam-authenticatorAll versions (No fix recorded)
aws-iam-authenticator-fipsAll versions (No fix recorded)
aws-node-termination-handlerAll versions (No fix recorded)
aws-node-termination-handler-fipsAll versions (No fix recorded)
aws-s3-controllerAll versions (No fix recorded)
azure-ipamAll versions (No fix recorded)
azure-metrics-exporterAll versions (No fix recorded)
azure-metrics-exporter-fipsAll versions (No fix recorded)
azurefile-csi-fips-1.33All versions (No fix recorded)
backup-restore-operator-10.0All versions (No fix recorded)
backup-restore-operator-7.0< 7.0.11-r1
backup-restore-operator-8.1All versions (No fix recorded)
backup-restore-operator-9.0< 9.0.8-r1 | All versions (No fix recorded)
backup-restore-operator-fips-10.0All versions (No fix recorded)
backup-restore-operator-fips-7.0All versions (No fix recorded)
backup-restore-operator-fips-8.1All versions (No fix recorded)
backup-restore-operator-fips-9.0All versions (No fix recorded)
blobfuse2All versions (No fix recorded)
blobfuse2-fipsAll versions (No fix recorded)
calico-apiserver-3.30All versions (No fix recorded)
calico-apiserver-fips-3.30All versions (No fix recorded)
calico-app-policy-3.30All versions (No fix recorded)
calico-app-policy-fips-3.30All versions (No fix recorded)
calico-cni-3.30All versions (No fix recorded)
calico-cni-fips-3.30All versions (No fix recorded)
calico-felix-3.30All versions (No fix recorded)
calico-felix-fips-3.30All versions (No fix recorded)
calico-goldmane-3.30All versions (No fix recorded)
calico-goldmane-fips-3.30All versions (No fix recorded)
calico-key-cert-provisioner-3.30All versions (No fix recorded)
calico-key-cert-provisioner-fips-3.30All versions (No fix recorded)
calico-kube-controllers-3.30All versions (No fix recorded)
calico-kube-controllers-fips-3.30All versions (No fix recorded)
calico-node-3.30All versions (No fix recorded)
calico-node-fips-3.30All versions (No fix recorded)
calico-pod2daemon-3.30All versions (No fix recorded)
calico-pod2daemon-fips-3.30All versions (No fix recorded)
calico-typha-client-3.30All versions (No fix recorded)
calico-typha-client-fips-3.30All versions (No fix recorded)
calico-typhad-3.30All versions (No fix recorded)
calico-typhad-fips-3.30All versions (No fix recorded)
calico-whisker-backend-3.30All versions (No fix recorded)
calico-whisker-backend-fips-3.30All versions (No fix recorded)
calicoctl-3.30All versions (No fix recorded)
calicoctl-fips-3.30All versions (No fix recorded)
cert-exporterAll versions (No fix recorded)
cert-exporter-fipsAll versions (No fix recorded)
cert-manager-acmesolver-fips-1.19All versions (No fix recorded)
cert-manager-cainjector-fips-1.19All versions (No fix recorded)
cert-manager-controller-fips-1.19All versions (No fix recorded)
cert-manager-fips-1.19All versions (No fix recorded)
cert-manager-startupapicheck-fips-1.19All versions (No fix recorded)
cert-manager-webhook-fips-1.19All versions (No fix recorded)
cfsslAll versions (No fix recorded)
cfssl-bundleAll versions (No fix recorded)
cfssl-bundle-fipsAll versions (No fix recorded)
cfssl-certinfoAll versions (No fix recorded)
cfssl-certinfo-fipsAll versions (No fix recorded)
cfssl-fipsAll versions (No fix recorded)
cfssl-jsonAll versions (No fix recorded)
cfssl-json-fipsAll versions (No fix recorded)
cfssl-multirootcaAll versions (No fix recorded)
cfssl-multirootca-fipsAll versions (No fix recorded)
cfssl-newkeyAll versions (No fix recorded)
cfssl-newkey-fipsAll versions (No fix recorded)
cfssl-scanAll versions (No fix recorded)
cfssl-scan-fipsAll versions (No fix recorded)
cilium-certgen-0.1All versions (No fix recorded)
cilium-certgen-0.2All versions (No fix recorded)
cilium-certgen-0.3All versions (No fix recorded)
cilium-certgen-fips-0.1All versions (No fix recorded)
cilium-certgen-fips-0.2All versions (No fix recorded)
cilium-certgen-fips-0.3All versions (No fix recorded)
cis-operator-1.2All versions (No fix recorded)
cis-operator-1.3All versions (No fix recorded)
cis-operator-1.4All versions (No fix recorded)
clickhouse-operatorAll versions (No fix recorded)
clickhouse-operator-fipsAll versions (No fix recorded)
clickhouse-operator-fips-metrics-exporterAll versions (No fix recorded)
clickhouse-operator-metrics-exporterAll versions (No fix recorded)
cloud-provider-aws-fips-1.33-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.33-ecr-credential-providerAll versions (No fix recorded)
cluster-api-1.10-capd-managerAll versions (No fix recorded)
cluster-api-1.10-clusterctlAll versions (No fix recorded)
cluster-api-1.10-controllerAll versions (No fix recorded)
cluster-api-1.10-kubeadm-bootstrap-controllerAll versions (No fix recorded)
cluster-api-1.10-kubeadm-control-plane-controllerAll versions (No fix recorded)
cluster-autoscaler-1.33All versions (No fix recorded)
cluster-autoscaler-fips-1.33All versions (No fix recorded)
cluster-proportional-autoscalerAll versions (No fix recorded)
cluster-proportional-autoscaler-fipsAll versions (No fix recorded)
cluster-proportional-vertical-autoscalerAll versions (No fix recorded)
commercial-chainloop-backendAll versions (No fix recorded)
commercial-chainloop-cliAll versions (No fix recorded)
commercial-gitlab-workhorse-ee-19.2< 19.2.7-r0
commercial-gitlab-workhorse-ee-19.3< 19.3.3-r0
commercial-gitlab-workhorse-ee-fips-19.2All versions (No fix recorded) | < 19.2.7-r0
commercial-gitlab-workhorse-ee-fips-19.3All versions (No fix recorded) | < 19.3.3-r0
commercial-grafana-11.6All versions (No fix recorded)
commercial-grafana-12.1All versions (No fix recorded)
commercial-grafana-12.2All versions (No fix recorded)
commercial-grafana-12.3All versions (No fix recorded)
commercial-kyverno-1.14All versions (No fix recorded)
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-1.16All versions (No fix recorded)
commercial-kyverno-background-controller-1.14All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.16All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.14All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.16All versions (No fix recorded)
commercial-kyverno-reports-controller-1.14All versions (No fix recorded)
commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyverno-reports-controller-1.16All versions (No fix recorded)
commercial-kyvernopre-1.14All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
commercial-kyvernopre-1.16All versions (No fix recorded)
conjur-cliAll versions (No fix recorded)
consul-k8s-fips-1.1All versions (No fix recorded)
consul-k8s-fips-1.3All versions (No fix recorded)
consul-k8s-fips-1.5All versions (No fix recorded)
cueAll versions (No fix recorded)
cue-fipsAll versions (No fix recorded)
custom-pod-autoscalerAll versions (No fix recorded)
custom-pod-autoscaler-fipsAll versions (No fix recorded)
custom-pod-autoscaler-operatorAll versions (No fix recorded)
custom-pod-autoscaler-operator-fipsAll versions (No fix recorded)
datadog-agent-7.77All versions (No fix recorded)
datadog-agent-7.77-fakeintakeAll versions (No fix recorded)
datadog-agent-7.77-fullAll versions (No fix recorded)
datadog-agent-7.77-serverless-initAll versions (No fix recorded)
datadog-agent-fips-7.77All versions (No fix recorded)
datadog-agent-fips-7.77-fakeintakeAll versions (No fix recorded)
datadog-agent-fips-7.77-fullAll versions (No fix recorded)
datadog-agent-fips-7.77-serverless-initAll versions (No fix recorded)
datadog-cluster-agent-7.77All versions (No fix recorded)
datadog-cluster-agent-fips-7.77All versions (No fix recorded)
dex-k8s-authenticatorAll versions (No fix recorded)
docker-credential-acr-envAll versions (No fix recorded)
docker-credential-acr-env-fipsAll versions (No fix recorded)
docker-machine-driver-linodeAll versions (No fix recorded)
dogstatsd-7.77All versions (No fix recorded)
doppler-kubernetes-operatorAll versions (No fix recorded)
dragonfly-operatorAll versions (No fix recorded)
dragonfly-operator-fipsAll versions (No fix recorded)
elastic-agent-9.2All versions (No fix recorded)
elastic-agent-fips-9.2All versions (No fix recorded)
elastic-agent-fips-9.3All versions (No fix recorded)
elastic-otel-collector-fips-9.3All versions (No fix recorded)
emqx-exporterAll versions (No fix recorded)
emqx-exporter-fipsAll versions (No fix recorded)
envconsulAll versions (No fix recorded)
envconsul-fipsAll versions (No fix recorded)
envoy-gateway-1.6All versions (No fix recorded)
envoy-gateway-1.6-egctl< 1.6.7-r17
envoy-gateway-1.6-ratelimit-3fb70258All versions (No fix recorded)
etcd-3.4All versions (No fix recorded)
etcd-fips-3.4All versions (No fix recorded)
external-dns-infoblox-webhookAll versions (No fix recorded)
external-dns-infoblox-webhook-fipsAll versions (No fix recorded)
fairwinds-geminiAll versions (No fix recorded)
fairwinds-gemini-fipsAll versions (No fix recorded)
filebeat-fips-9.2All versions (No fix recorded)
filebeat-oss-7All versions (No fix recorded)
filebeat-oss-fips-7All versions (No fix recorded)
filebrowserAll versions (No fix recorded)
flux-source-watcherAll versions (No fix recorded)
flux-source-watcher-fipsAll versions (No fix recorded)
fluxcd-kustomize-mutating-webhookAll versions (No fix recorded)
fluxcd-kustomize-mutating-webhook-fipsAll versions (No fix recorded)
fwdctlAll versions (No fix recorded)
gcp-compute-persistent-disk-csi-driver-fips-1.13All versions (No fix recorded)
gcp-compute-persistent-disk-csi-driver-fips-1.18All versions (No fix recorded)
gcp-compute-persistent-disk-csi-driver-fips-1.25All versions (No fix recorded)
git-lfsAll versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 793. Use Open JSON for the complete list.

References

26 links

go.dev/cl/793360REPORTFIXARTICLE
go.dev/issue/80112REPORTARTICLE
pkg.go.dev/vuln/GO-2026-6629REPORTAdvisory
ubuntu.com/security/CVE-2026-56851REPORT
www.cve.org/CVERecord?id=CVE-2026-56851REPORTAdvisory
github.com/golang/go/issues/80112REPORT
security-tracker.debian.org/tracker/CVE-2026-56851Advisory
access.redhat.com/errata/RHSA-2026:70537Advisory
images.redhat.comARTICLE
access.redhat.com/security/cve/CVE-2026-56851REPORT

Show all 26 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities