CVE-2026-56859
CVE
High
Medium Impactencoding/xml: Stack Exhaustion via Depth Counter Reset in DecodeElement
Exploitable under specific conditions
This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.
Reachable when KrakenD decodes an XML payload, either a backend response processed
by the XML encoding component or an XML request body accepted from a client.
Deployments that don’t use XML encoding/decoding are not exposed.
Component
Go standard library (encoding/xml)
Disclosed
Aug 14, 2026
Description
Go’s
encoding/xml package reset its recursion depth counter inside
Decoder.DecodeElement, so the guard meant to stop deeply nested XML documents from
recursing indefinitely never actually fired. A crafted XML document with many nested
elements could drive the decoder into unbounded recursion, exhausting the goroutine’s
stack and crashing the process. The fix restores the depth counter so it persists
across nested DecodeElement calls.Version summary
Community Edition
2.13.9
addresses this advisory
Affected CE versions
>= 2.0, < 2.13.9
Enterprise Edition
2.13.7
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.7
Upgrade to the addressed version or later to remediate this vulnerability.