CVE-2026-56852: Golang.org/x/text Golang.org/x/text/unicode/norm

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Affected products

• Golang.org/x/text Golang.org/x/text/unicode/norm: before 0.39.0 (fixed in 0.39.0)

Published 2026-07-21. Last modified 2026-07-23.