encoding/xml: (*Decoder).DecodeElement bypasses recursion-depth guard

[jitsu-net]

Previously, DecodeElement would reset the depth counter
causing it to never fire; this could lead to stack
exhaustion.

Thanks to Moran Omer (GitHub: moraneus) for reporting this issue.

This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.

---

This was a PUBLIC track issue, tracked in http://b/523596497.

[gopherbot]

Change https://go.dev/cl/803320 mentions this issue: encoding/xml: fix depth processing in unmarshal

[gabyhelp]

Related Issues

• encoding/xml: stack exhaustion in Decoder.Skip #53614 (closed)
• encoding/xml: stack exhaustion in Unmarshal #53611 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[jitsu-net]

@gopherbot Please open backport for this security issue.

[gopherbot]

Backport issue(s) opened: #80627 (for 1.25), #80628 (for 1.26).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/807520 mentions this issue: encoding/xml: fix depth processing in (*Decoder).unmarshal

[gopherbot]

Change https://go.dev/cl/807520 mentions this issue: [release-branch.go1.25] encoding/xml: fix depth processing in (*Decoder).unmarshal

[gopherbot]

Change https://go.dev/cl/807540 mentions this issue: [release-branch.go1.26] encoding/xml: fix depth processing in (*Decoder).unmarshal

[dmitshur]

Reopening and moving to Go 1.27 milestone to track cherry-picking CL 803320 onto release-branch.go1.27, as noted here.