Read the docs
TI-2026-69257 Aliases CVE-2026-56851GHSA-gx9w-9qq8-m485

Panic in golang.org/x/text Nickname profile parsing crafted input

Priority LOW 39CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

The golang.org/x/text/secure/precis package from 0 before 0.41.0 is affected. The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer, a flaw classified as CWE-787. A remote unauthenticated attacker can crash the affected program by sending such input, without user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00466 40th percentileScored 2026-11-07
Fix Partial golang.org/x/text/secure/precis (golang.org/x/text): 0.41.0Red Hat: 27 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
golang.org/x/textgolang.org/x/text/secure/precisbefore 0.41.00.41.0Patch availableCNA
  • golang.org/x/text/secure/precis Vendorgolang.org/x/text Affected before 0.41.0 Fixed in 0.41.0 Patch available CNA

Remediation

Upgrade golang.org/x/text/secure/precis to version 0.41.0 or later. Red Hat fixes it in Hardened Images and OpenShift Builds 1.8.3 and 1.9.2 through advisories including RHSA-2026:89131, RHSA-2026:89081 and RHSA-2026:76677. The sources list no fixed version for Red Hat OpenShift AI (RHOAI).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA golang.org/x/text/secure/precis (golang.org/x/text) Fixed in 0.41.0

Red Hat 27 advisories

  • RHSA-2026:89131 Released 2026-10-24 · Red Hat rating Critical
    Red Hat OpenShift Builds 1.9.2
    • Red Hat OpenShift Builds 1.9.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10 +6
  • RHSA-2026:89081 Released 2026-10-24 · Red Hat rating Critical
    Red Hat OpenShift Builds 1.8.3
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +6
  • RHSA-2026:89041 Released 2026-10-24 · Red Hat rating Important
    Red Hat OpenShift Builds 1.9.2
    • Red Hat OpenShift Builds 1.9.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10 +7
Show 24 more Red Hat advisories
  • RHSA-2026:89031 Released 2026-10-24 · Red Hat rating Important
    Red Hat OpenShift Builds 1.8.3
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +7
  • RHSA-2026:76677 Released 2026-10-06 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images grafana12.4-12.4.12-0.4.hum1@aarch64, grafana12.4-12.4.12-0.4.hum1@src, grafana12.4-12.4.12-0.4.hum1@x86_64
  • RHSA-2026:76606 Released 2026-10-06 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images fulcio-1.9.0-0.1.hum1@aarch64, fulcio-1.9.0-0.1.hum1@src, fulcio-1.9.0-0.1.hum1@x86_64
  • RHSA-2026:76448 Released 2026-10-05 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images grafana13.1-13.1.7-0.1.hum1@aarch64, grafana13.1-13.1.7-0.1.hum1@src, grafana13.1-13.1.7-0.1.hum1@x86_64
  • RHSA-2026:76430 Released 2026-10-05 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images grafana13.2-13.2.3-0.1.hum1@aarch64, grafana13.2-13.2.3-0.1.hum1@src, grafana13.2-13.2.3-0.1.hum1@x86_64
  • RHSA-2026:75151 Released 2026-10-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images caddy-2.11.7-0.1.hum1@aarch64, caddy-2.11.7-0.1.hum1@src, caddy-2.11.7-0.1.hum1@x86_64
  • RHSA-2026:74948 Released 2026-10-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images opentofu1.12-1.12.7-0.1.hum1@aarch64, opentofu1.12-1.12.7-0.1.hum1@src, opentofu1.12-1.12.7-0.1.hum1@x86_64
  • RHSA-2026:74861 Released 2026-10-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images podman-6.1.3-1.hum1@aarch64, podman-6.1.3-1.hum1@src, podman-6.1.3-1.hum1@x86_64 +8
  • RHSA-2026:74536 Released 2026-10-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images oauth2-proxy-7.15.5-0.1.hum1@aarch64, oauth2-proxy-7.15.5-0.1.hum1@src, oauth2-proxy-7.15.5-0.1.hum1@x86_64
  • RHSA-2026:73524 Released 2026-09-29 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentelemetry-collector-0.162.0-0.1.hum1@aarch64, opentelemetry-collector-0.162.0-0.1.hum1@src, opentelemetry-collector-0.162.0-0.1.hum1@x86_64
  • RHSA-2026:73523 Released 2026-09-29 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentelemetry-collector-contrib-0.162.0-0.1.hum1@aarch64, opentelemetry-collector-contrib-0.162.0-0.1.hum1@src, opentelemetry-collector-contrib-0.162.0-0.1.hum1@x86_64
  • RHSA-2026:73522 Released 2026-09-29 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentelemetry-collector-k8s-0.162.0-0.1.hum1@aarch64, opentelemetry-collector-k8s-0.162.0-0.1.hum1@src, opentelemetry-collector-k8s-0.162.0-0.1.hum1@x86_64
  • RHSA-2026:73401 Released 2026-09-29 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images distribution-3.1.2-0.1.hum1@aarch64, distribution-3.1.2-0.1.hum1@src, distribution-3.1.2-0.1.hum1@x86_64
  • RHSA-2026:72750 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images prometheus3.13-3.13.3-0.2.hum1@aarch64, prometheus3.13-3.13.3-0.2.hum1@src, prometheus3.13-3.13.3-0.2.hum1@x86_64
  • RHSA-2026:72570 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images loki3.6-3.6.17-0.3.hum1@aarch64, loki3.6-3.6.17-0.3.hum1@src, loki3.6-3.6.17-0.3.hum1@x86_64 +4
  • RHSA-2026:72496 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images loki3.7-3.7.8-0.3.hum1@aarch64, loki3.7-3.7.8-0.3.hum1@src, loki3.7-3.7.8-0.3.hum1@x86_64 +4
  • RHSA-2026:70700 Released 2026-09-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images golang1.27-1.27.1-2.hum1@aarch64, golang1.27-1.27.1-2.hum1@src, golang1.27-1.27.1-2.hum1@x86_64 +10
  • RHSA-2026:70670 Released 2026-09-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images buildah-1.45.1-1.hum1@aarch64, buildah-1.45.1-1.hum1@src, buildah-1.45.1-1.hum1@x86_64
  • RHSA-2026:70537 Released 2026-09-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images etcd-3.7.2-0.1.hum1@aarch64, etcd-3.7.2-0.1.hum1@src, etcd-3.7.2-0.1.hum1@x86_64
  • RHSA-2026:70031 Released 2026-09-22 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images k6v2-2.3.0-0.1.hum1@aarch64, k6v2-2.3.0-0.1.hum1@src, k6v2-2.3.0-0.1.hum1@x86_64
  • RHSA-2026:68729 Released 2026-09-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images helm4-4.3.0-0.2.hum1@aarch64, helm4-4.3.0-0.2.hum1@src, helm4-4.3.0-0.2.hum1@x86_64
  • RHSA-2026:68717 Released 2026-09-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images helm3-3.22.0-0.2.hum1@aarch64, helm3-3.22.0-0.2.hum1@src, helm3-3.22.0-0.2.hum1@x86_64
  • RHSA-2026:62391 Released 2026-09-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images golang1.26-1.26.8-0.1.hum1@aarch64, golang1.26-1.26.8-0.1.hum1@src, golang1.26-1.26.8-0.1.hum1@x86_64 +10
  • RHSA-2026:58472 Released 2026-08-22 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images rekor-1.5.4-0.1.hum1@src, rekor-server-1.5.4-0.1.hum1@aarch64, rekor-server-1.5.4-0.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Hardened ImagesFixed RHSA-2026:58472, RHSA-2026:62391, RHSA-2026:68717, RHSA-2026:68729, RHSA-2026:70031, RHSA-2026:70537, RHSA-2026:70670, RHSA-2026:70700, RHSA-2026:72496, RHSA-2026:72570, RHSA-2026:72750, RHSA-2026:73401, RHSA-2026:73522, RHSA-2026:73523, RHSA-2026:73524, RHSA-2026:74536, RHSA-2026:74861, RHSA-2026:74948, RHSA-2026:75151, RHSA-2026:76430, RHSA-2026:76448, RHSA-2026:76606, RHSA-2026:76677
Red Hat OpenShift Builds 1.8.3Fixed RHSA-2026:89031, RHSA-2026:89081
Red Hat OpenShift Builds 1.9.2Fixed RHSA-2026:89041, RHSA-2026:89131
Not affected: 3 products
  • Red Hat Hardened Images
  • Red Hat OpenShift Builds 1.8.3
  • Red Hat OpenShift Builds 1.9.2

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-56851
  2. 2026-10-07 Alias added: GHSA-gx9w-9qq8-m485
  3. 2026-10-08 CVSS score added · CISA ADP
  4. 2026-10-08 Weakness changed · CISA ADP
  5. 2026-10-08 CISA SSVC decision points changed
  6. 2026-10-20 Fix available: RHSA-2026:58472 · Red Hat
  7. 2026-10-20 Fix available: RHSA-2026:62391 · Red Hat
  8. 2026-10-20 Fix available: RHSA-2026:70700 · Red Hat
  9. 2026-10-20 Fix available: RHSA-2026:72750 · Red Hat
  10. 2026-10-20 Fix available: RHSA-2026:68717 · Red Hat
  11. 2026-10-20 Fix available: RHSA-2026:68729 · Red Hat
  12. 2026-10-20 Fix available: RHSA-2026:70537 · Red Hat
  13. 2026-10-20 Fix available: RHSA-2026:70670 · Red Hat
  14. 2026-10-20 Fix available: RHSA-2026:70031 · Red Hat
  15. 2026-10-20 Fix available: RHSA-2026:73401 · Red Hat
  16. 2026-10-20 Fix available: RHSA-2026:73522 · Red Hat
  17. 2026-10-20 Fix available: RHSA-2026:73523 · Red Hat
  18. 2026-10-20 Fix available: RHSA-2026:73524 · Red Hat
  19. 2026-10-20 Fix available: RHSA-2026:74536 · Red Hat
  20. 2026-10-20 Fix available: RHSA-2026:74861 · Red Hat
  21. 2026-10-20 Fix available: RHSA-2026:75151 · Red Hat
  22. 2026-10-20 Fix available: RHSA-2026:74948 · Red Hat
  23. 2026-10-20 Fix available: RHSA-2026:76606 · Red Hat
  24. 2026-10-20 Fix available: RHSA-2026:72496 · Red Hat
  25. 2026-10-20 Fix available: RHSA-2026:72570 · Red Hat
  26. 2026-10-20 Fix available: RHSA-2026:76430 · Red Hat
  27. 2026-10-20 Fix available: RHSA-2026:76677 · Red Hat
  28. 2026-10-20 Fix available: RHSA-2026:76448 · Red Hat
  29. 2026-10-20 Fix available: Red Hat Hardened Images · Red Hat
  30. 2026-10-20 CVSS score added · Red Hat
  31. 2026-10-25 Fix available: RHSA-2026:89081 · Red Hat
  32. 2026-10-25 Fix available: RHSA-2026:89031 · Red Hat
  33. 2026-10-25 Fix available: RHSA-2026:89131 · Red Hat
  34. 2026-10-25 Fix available: RHSA-2026:89041 · Red Hat
  35. 2026-10-25 Fix available: Red Hat OpenShift Builds 1.8.3, Red Hat OpenShift Builds 1.9.2 · Red Hat
  36. 2026-11-06 Affected versions changed · Red Hat

References

Other 3

  • TI-2026-40992 Infinite loop on invalid input in golang.org/x/text CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences