A vulnerability, which was classified as problematic, was found in Go encoding and xml up to 1.25.12/1.26.5. This affects the function
DecodeElement. Such manipulation leads to allocation of resources.
This vulnerability is referenced as CVE-2026-56859. It is possible to launch the attack remotely. No exploit is available.
You should upgrade the affected component.
