CVE-2026-56852: norm.Iter DOS Vulnerability

CVE-2026-56852 Overview

CVE-2026-56852 is a denial-of-service vulnerability in the Go golang.org/x/text/unicode/norm package. A norm.Iter value enters an infinite loop when processing input that contains invalid UTF-8 byte sequences. Applications that pass untrusted byte input to norm.Iter for Unicode normalization can be forced to consume CPU indefinitely on a single request. The flaw is tracked upstream as GO-2026-5970 and is classified under CWE-835: Loop with Unreachable Exit Condition.

Critical Impact
A network-reachable attacker can trigger an infinite loop by submitting crafted invalid UTF-8 bytes to any Go service that normalizes user-supplied text using norm.Iter, causing sustained CPU exhaustion and service unavailability.

Affected Products

Go golang.org/x/text/unicode/norm package (Unicode normalization iterator)
Go applications and services that pass untrusted input to norm.Iter
Downstream libraries and frameworks depending on golang.org/x/text

Discovery Timeline

2026-07-21 - CVE-2026-56852 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-56852

Vulnerability Analysis

The vulnerability lives in the iterator logic of golang.org/x/text/unicode/norm. norm.Iter walks a byte slice or string and yields normalized Unicode segments. When the underlying input contains malformed UTF-8, the iterator fails to advance past the invalid bytes and re-enters the same processing state on every step. The loop has no reachable exit condition for this input class, matching CWE-835.

The impact profile is availability-only. There is no memory corruption, no information disclosure, and no integrity violation. However, the loop runs on the goroutine servicing the request, so a single crafted payload can pin one CPU core. Repeated requests exhaust the process worker pool and stall the service.

Details are available in the Go vulnerability report GO-2026-5970 and the Go issue tracker entry 80142.

Root Cause

The iterator does not treat invalid UTF-8 as a terminal or recoverable condition. Instead of skipping the invalid byte or reporting an error, the internal position pointer stops advancing while the state machine keeps requesting more input. This produces an unbounded loop without ever consuming another byte.

Attack Vector

The attack is remote and unauthenticated whenever a Go service normalizes attacker-controlled input. Common exposure paths include HTTP request handlers that call Unicode normalization on headers, query parameters, JSON fields, or uploaded text before storing or comparing them. The attacker submits a small payload containing a malformed UTF-8 sequence and the handling goroutine never returns.

No exploit code is public and the CVE is not listed in CISA KEV. Refer to the upstream code review CL 794100 for the corrective patch.

Detection Methods for CVE-2026-56852

Indicators of Compromise

Individual Go process goroutines stuck at 100% CPU with stack traces inside golang.org/x/text/unicode/norm iterator functions.
HTTP request latency and timeouts increasing sharply after receiving requests containing non-UTF-8 byte sequences.
Growing goroutine counts in Go runtime metrics (go_goroutines) without a corresponding drop after request completion.

Detection Strategies

Capture periodic goroutine profiles with pprof and alert on repeated frames in norm.(*Iter).Next or related iterator methods.
Inspect application logs and WAF telemetry for request bodies or fields containing invalid UTF-8 continuation bytes reaching normalization code paths.
Correlate spikes in per-request CPU time with the presence of binary or non-UTF-8 payloads in text fields expected to be UTF-8.

Monitoring Recommendations

Export Go runtime metrics through Prometheus and alert on sustained increases in goroutine count or CPU per request.
Set hard request-processing timeouts and context.Context deadlines on every handler that performs normalization.
Track dependency versions of golang.org/x/text across services and flag versions preceding the GO-2026-5970 fix.

How to Mitigate CVE-2026-56852

Immediate Actions Required

Update golang.org/x/text to the fixed version identified in the GO-2026-5970 advisory and rebuild all Go binaries that depend on it.
Audit code paths that call norm.Iter, norm.Form.Iter, or wrappers such as norm.NFC.Bytes on untrusted input.
Enforce request timeouts and body size limits on any endpoint that performs Unicode normalization on user input.

Patch Information

The fix is delivered through the upstream Go text repository. Review the Go code review CL 794100 for the exact change and consult the Go issue tracker entry 80142 for context. Update the module dependency with go get golang.org/x/text@latest and verify with govulncheck ./..., which reports GO-2026-5970 on affected builds.

Workarounds

Validate that input is well-formed UTF-8 with utf8.Valid before passing it to norm.Iter and reject or sanitize malformed input.
Wrap normalization calls in a goroutine guarded by a context.WithTimeout so the runaway loop can be abandoned by the caller.
Replace direct norm.Iter usage with norm.Form.Bytes or norm.Form.String on pre-validated input where iteration semantics are not required.

bash

# Verify affected modules and apply the fix
govulncheck ./...
go get golang.org/x/text@latest
go mod tidy
go build ./...