CVE-2026-56851

Panic parsing crafted input in x/text/secure/precis in golang.org/x/text

7.5 HighFix available

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.47%Up 0.3 points since Oct 8, 2026

What each source reports

CVE List Score used 7.5

Panic parsing crafted input in x/text/secure/precis in golang.org/x/text

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Record: CVE-2026-56851
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2026-94532 7.5

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Record: EUVD-2026-94532
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-gx9w-9qq8-m485 7.5

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input...

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Record: GHSA-gx9w-9qq8-m485
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

NVD 7.5

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Record: CVE-2026-56851
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVBELL-CVE-2026-56851 7.5

CVE-2026-56851 does not affect BellSoft software

Record: BELL-CVE-2026-56851
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-56851 7.5

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Record: DEBIAN-CVE-2026-56851
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 27 moreShow less

OSVRHSA-2026:58472 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:58472
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:62391 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:62391
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:68717 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:68717
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68729 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:68729
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:70031 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:70031
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:70537 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:70537
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:70670 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:70670
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:70700 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:70700
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:72496 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:72496
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:72570 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:72570
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:72750 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:72750
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:73401 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:73401
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:73522 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:73522
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:73523 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:73523
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:73524 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:73524
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:74536 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:74536
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:74861 8.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:74861
CVSS 3.1: 8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:74948 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:74948
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:75151 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:75151
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:76430 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:76430
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:76448 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:76448
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:76606 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:76606
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:76677 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:76677
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-56851 7.5

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Record: UBUNTU-CVE-2026-56851
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-107610 No score

CVE-2026-56851 affecting package keda for versions less than 2.14.1-19

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Record: AZL-107610
Updated: 2026-11-02

OSVGO-2026-6629 No score

Panic parsing crafted input in x/text/secure/precis in golang.org/x/text

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Record: GO-2026-6629
Updated: 2026-11-02

OSVROOT-APP-GOBINARY-CVE-2026-56851 No score

CVE-2026-56851 in golang.org/x/text - Patched by Root

Root has patched CVE-2026-56851 in the golang.org/x/text package for Root:Go. Multiple fixed versions available.

Record: ROOT-APP-GOBINARY-CVE-2026-56851
Updated: 2026-11-02

Affected products

golang.org/x/text golang.org/x/text/secure/precis

Affected packages

Affected packages
Package	Affected	Fixed
`keda` Azure Linux:3	before 2.14.1-19	2.14.1-19
`golang-golang-x-text` Debian:12	All versions, plus listed versions 0.10.0-10.11.0-10.12.0-10.13.0-10.14.0-1 Show 16 moreShow less 0.14.0-20.15.0-10.16.0-10.16.0-1~bpo12+10.22.0-10.29.0-10.29.0-20.31.0-10.32.0-10.35.0-10.36.0-10.36.0-1~bpo13+10.40.0-10.41.0-10.7.0-10.9.0-1	None known
`golang-golang-x-text` Debian:13	All versions, plus listed versions 0.22.0-10.29.0-10.29.0-20.31.0-10.32.0-1 Show 5 moreShow less 0.35.0-10.36.0-10.36.0-1~bpo13+10.40.0-10.41.0-1	None known
`golang-golang-x-text` Debian:14	before 0.41.0-1, plus listed versions 0.22.0-10.29.0-10.29.0-20.31.0-10.32.0-1 Show 4 moreShow less 0.35.0-10.36.0-10.36.0-1~bpo13+10.40.0-1	0.41.0-1
`golang.org/x/text` Go	before 0.41.0	0.41.0
`rekor` Red Hat:hummingbird:1 From an advisory covering 2 CVEs	before 0:1.5.4-0.1.hum1	0:1.5.4-0.1.hum1
`rekor-server` Red Hat:hummingbird:1 From an advisory covering 2 CVEs	before 0:1.5.4-0.1.hum1	0:1.5.4-0.1.hum1
`golang1.26` Red Hat:hummingbird:1 From an advisory covering 10 CVEs	before 0:1.26.8-0.1.hum1	0:1.26.8-0.1.hum1
`golang1.26-bin` Red Hat:hummingbird:1 From an advisory covering 10 CVEs	before 0:1.26.8-0.1.hum1	0:1.26.8-0.1.hum1
`golang1.26-docs` Red Hat:hummingbird:1 From an advisory covering 10 CVEs	before 0:1.26.8-0.1.hum1	0:1.26.8-0.1.hum1

Show 47 moreShow less

Affected packages
Package	Affected	Fixed
`golang1.26-misc` Red Hat:hummingbird:1 From an advisory covering 10 CVEs	before 0:1.26.8-0.1.hum1	0:1.26.8-0.1.hum1
`golang1.26-src` Red Hat:hummingbird:1 From an advisory covering 10 CVEs	before 0:1.26.8-0.1.hum1	0:1.26.8-0.1.hum1
`golang1.26-tests` Red Hat:hummingbird:1 From an advisory covering 10 CVEs	before 0:1.26.8-0.1.hum1	0:1.26.8-0.1.hum1
`helm3` Red Hat:hummingbird:1 From an advisory covering 5 CVEs	before 0:3.22.0-0.2.hum1	0:3.22.0-0.2.hum1
`helm4` Red Hat:hummingbird:1 From an advisory covering 5 CVEs	before 0:4.3.0-0.2.hum1	0:4.3.0-0.2.hum1
`k6v2` Red Hat:hummingbird:1 From an advisory covering 2 CVEs	before 0:2.3.0-0.1.hum1	0:2.3.0-0.1.hum1
`etcd` Red Hat:hummingbird:1	before 0:3.7.2-0.1.hum1	0:3.7.2-0.1.hum1
`buildah` Red Hat:hummingbird:1 From an advisory covering 2 CVEs	before 0:1.45.1-1.hum1	0:1.45.1-1.hum1
`golang1.27` Red Hat:hummingbird:1	before 0:1.27.1-2.hum1	0:1.27.1-2.hum1
`golang1.27-bin` Red Hat:hummingbird:1	before 0:1.27.1-2.hum1	0:1.27.1-2.hum1
`golang1.27-docs` Red Hat:hummingbird:1	before 0:1.27.1-2.hum1	0:1.27.1-2.hum1
`golang1.27-misc` Red Hat:hummingbird:1	before 0:1.27.1-2.hum1	0:1.27.1-2.hum1
`golang1.27-src` Red Hat:hummingbird:1	before 0:1.27.1-2.hum1	0:1.27.1-2.hum1
`golang1.27-tests` Red Hat:hummingbird:1	before 0:1.27.1-2.hum1	0:1.27.1-2.hum1
`loki3.7` Red Hat:hummingbird:1 From an advisory covering 4 CVEs	before 0:3.7.8-0.3.hum1	0:3.7.8-0.3.hum1
`loki3.7-canary` Red Hat:hummingbird:1 From an advisory covering 4 CVEs	before 0:3.7.8-0.3.hum1	0:3.7.8-0.3.hum1
`loki3.7-logcli` Red Hat:hummingbird:1 From an advisory covering 4 CVEs	before 0:3.7.8-0.3.hum1	0:3.7.8-0.3.hum1
`loki3.6` Red Hat:hummingbird:1 From an advisory covering 5 CVEs	before 0:3.6.17-0.3.hum1	0:3.6.17-0.3.hum1
`loki3.6-canary` Red Hat:hummingbird:1 From an advisory covering 5 CVEs	before 0:3.6.17-0.3.hum1	0:3.6.17-0.3.hum1
`loki3.6-logcli` Red Hat:hummingbird:1 From an advisory covering 5 CVEs	before 0:3.6.17-0.3.hum1	0:3.6.17-0.3.hum1
`prometheus3.13` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:3.13.3-0.2.hum1	0:3.13.3-0.2.hum1
`distribution` Red Hat:hummingbird:1	before 0:3.1.2-0.1.hum1	0:3.1.2-0.1.hum1
`opentelemetry-collector-k8s` Red Hat:hummingbird:1	before 0:0.162.0-0.1.hum1	0:0.162.0-0.1.hum1
`opentelemetry-collector-contrib` Red Hat:hummingbird:1 From an advisory covering 2 CVEs	before 0:0.162.0-0.1.hum1	0:0.162.0-0.1.hum1
`opentelemetry-collector` Red Hat:hummingbird:1	before 0:0.162.0-0.1.hum1	0:0.162.0-0.1.hum1
`oauth2-proxy` Red Hat:hummingbird:1 From an advisory covering 2 CVEs	before 0:7.15.5-0.1.hum1	0:7.15.5-0.1.hum1
`podman` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.3-1.hum1	0:6.1.3-1.hum1
`podman-docker` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.3-1.hum1	0:6.1.3-1.hum1
`podman-machine` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.3-1.hum1	0:6.1.3-1.hum1
`podman-remote` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.3-1.hum1	0:6.1.3-1.hum1
`podmansh` Red Hat:hummingbird:1 From an advisory covering 3 CVEs	before 0:6.1.3-1.hum1	0:6.1.3-1.hum1
`opentofu1.12` Red Hat:hummingbird:1 From an advisory covering 2 CVEs	before 0:1.12.7-0.1.hum1	0:1.12.7-0.1.hum1
`caddy` Red Hat:hummingbird:1	before 0:2.11.7-0.1.hum1	0:2.11.7-0.1.hum1
`grafana13.2` Red Hat:hummingbird:1 From an advisory covering 9 CVEs	before 0:13.2.3-0.1.hum1	0:13.2.3-0.1.hum1
`grafana13.1` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:13.1.7-0.1.hum1	0:13.1.7-0.1.hum1
`fulcio` Red Hat:hummingbird:1	before 0:1.9.0-0.1.hum1	0:1.9.0-0.1.hum1
`grafana12.4` Red Hat:hummingbird:1 From an advisory covering 12 CVEs	before 0:12.4.12-0.4.hum1	0:12.4.12-0.4.hum1
`golang.org/x/text` Root:Go	before v0.40.0-aikido.1	v0.40.0-aikido.1v0.38.0-aikido.2v0.23.0-aikido.2v0.13.0-aikido.2v0.39.0-aikido.1v0.31.0-aikido.1v0.22.0-aikido.2v0.25.0-aikido.2v0.35.0-aikido.2v0.28.0-aikido.2v0.26.0-aikido.2v0.28.0-aikido.3v0.32.0-aikido.2v0.39.0-aikido.2v0.37.0-aikido.2v0.32.0-aikido.3v0.22.0-aikido.3v0.39.0-aikido.3v0.31.0-aikido.2v0.26.0-aikido.3v0.37.0-aikido.3v0.28.0-aikido.4v0.18.0-aikido.2v0.33.0-aikido.2v0.14.0-aikido.2
`rootio-golang.org/x/text` Root:Go	before v0.40.0-root.io.1	v0.40.0-root.io.1v0.38.0-root.io.2v0.23.0-root.io.2v0.13.0-root.io.2v0.39.0-root.io.1v0.31.0-root.io.1v0.22.0-root.io.2v0.25.0-root.io.2v0.35.0-root.io.2v0.28.0-root.io.2v0.26.0-root.io.2v0.28.0-root.io.3v0.32.0-root.io.2v0.39.0-root.io.2v0.37.0-root.io.2v0.32.0-root.io.3v0.22.0-root.io.3v0.39.0-root.io.3v0.31.0-root.io.2v0.26.0-root.io.3v0.37.0-root.io.3v0.28.0-root.io.4v0.18.0-root.io.2v0.33.0-root.io.2v0.14.0-root.io.2
`golang-x-text` Ubuntu:16.04:LTS	All versions, plus listed versions 0+git20151019.0fe7e68-0ubuntu10+git20151217.cf49866-0ubuntu1	None known
`golang-x-text` Ubuntu:18.04:LTS	All versions, plus listed versions 0.0~git20170627.0.6353ef0-1ubuntu10.0~git20170627.0.6353ef0-1ubuntu20.0~git20170627.0.6353ef0-1ubuntu2.1	None known
`golang-golang-x-text` Ubuntu:20.04:LTS	All versions, plus listed versions 0.3.2-30.3.2-40.3.2-4ubuntu0.1	None known
`golang-x-text` Ubuntu:20.04:LTS	All versions, plus listed versions 0.3.2-1	None known
`golang-golang-x-text` Ubuntu:22.04:LTS	All versions, plus listed versions 0.3.6-10.3.7-10.3.7-1ubuntu0.20.04.1	None known
`golang-golang-x-text` Ubuntu:24.04:LTS	All versions, plus listed versions 0.9.0-10.13.0-10.14.0-10.14.0-2	None known
`golang-golang-x-text` Ubuntu:26.10	All versions, plus listed versions 0.31.0-10.36.0-10.40.0-1	None known
`golang-golang-x-text` Ubuntu:26.04:LTS	All versions, plus listed versions 0.22.0-10.31.0-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	affected, aliases, references
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56851 is a high vulnerability (CVSS 7.5) in Golang.org/x/text Golang.org/x/text/secure/precis, published September 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in keda 2.14.1-19.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 90 references. The JSON record has them.