Is CVE-2026-56851 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56851 being exploited in the wild.

How severe is CVE-2026-56851?

Informational severity, published 7 October 2026.

Which products and versions are affected?

golang.org/x/text (Go) SEMVER:introduced=0,fixed=0.41.0.

Is there a fix for CVE-2026-56851?

Yes. golang.org/x/text (Go): upgrade to 0.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56851 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56851?

Check whether you run golang.org/x/text (Go) or x/text (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56851: golang.org/x/text panic in precis nickname mapping

CVE-2026-56851 · Severity: info · Published 2026-10-07

golang.org/x/text is a Go library that processes and validates text in compliance with international standards. A vulnerability in its PRECIS (Preparation, Enforcement, and Comparison of Internationalized Strings) module allows an attacker to craft malicious input that causes the application to crash, leading to denial of service. Any Go application that uses the text/secure/precis package to validate user-supplied strings is affected.

Technologies: golang.org/x/text (Go). Vendors: Go.

Quick answers

Is CVE-2026-56851 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56851 being exploited in the wild.
How severe is CVE-2026-56851?: Informational severity, published 7 October 2026.
Which products and versions are affected?: golang.org/x/text (Go) SEMVER:introduced=0,fixed=0.41.0.
Is there a fix for CVE-2026-56851?: Yes. golang.org/x/text (Go): upgrade to 0.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56851 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56851?: Check whether you run golang.org/x/text (Go) or x/text (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/text (Go): upgrade to 0.41.0 or later
```
go get golang.org/x/text@v0.41.0
```

Technical details

The vulnerability is a panic in the nickAdditionalMapping.Transform() function within the x/text/secure/precis module when parsing crafted input. The vulnerability can be triggered by providing specially designed strings to functions that process PRECIS nickname profiles. An attacker with the ability to supply input that is processed by the PRECIS module can trigger an unhandled panic, causing a denial of service.

Affected products

golang x/text

Identifiers

CVE-2026-56851
GO-2026-6629

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.