VDB
GO-2026-6088
GO-2026-6088
PUBLISHED
Record from OSV · Published August 13, 2026
Add recursion depth guard during decode in encoding/xml
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| octo-sts | Wolfi | 0.8.0-r1 |
| cilium-certgen-0.3 | Chainguard | 0.3.2-r13 |
| kubelet-csr-approver | Chainguard | 1.2.14-r7 |
| rancher-fleet-fips | Chainguard | 0.16.0-r2 |
| tetragon-fips | Chainguard | 1.7.0-r10 |
| crossplane-provider-azure-portal | Chainguard | 2.7.0-r1 |
| crossplane-provider-aws-guardduty-fips | Chainguard | 2.7.0-r0 |
| crossplane-provider-aws-kinesisanalytics | Chainguard | 2.7.0-r1 |
| crossplane-provider-aws-guardduty | Chainguard | 2.7.0-r1 |
| crossplane-provider-aws-pinpoint | Chainguard | 2.7.0-r1 |
| crossplane-provider-aws-kafkaconnect-fips | Chainguard | 2.7.0-r1 |
| kubernetes-dashboard-web-fips | Chainguard | 1.7.0-r20 |
88 more packages have a fixed version. See every fix in Lookup.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | tetragon-fips | 0 |
| chainguard | hcl2json | * |
| chainguard | crossplane-provider-aws-pinpoint | 0 |
| chainguard | nri-rabbitmq-fips | * |
| wolfi | rqlite | * |
| chainguard | crossplane-provider-aws-kafkaconnect-fips | 0 |
| chainguard | kubernetes-dashboard-web-fips | 0 |
| chainguard | nvidia-nsight-compute-13.2 | 0 |
| chainguard | gpu-operator-24.9 | 0 |
| chainguard | kubernetes-csi-driver-hostpath | * |
| wolfi | git-lfs | * |
| wolfi | minio-object-browser | 0 |
| chainguard | docker-fips-29 | * |
| wolfi | step-issuer | 0, 0 |
| chainguard | vitess-22 | * |
| chainguard | request-1279 | 0 |
| wolfi | knative-eventing-1.21 | 0 |
| wolfi | crossplane-provider-aws-kinesis | 0 |
| chainguard | opencost | 0 |
| chainguard | smokescreen | * |
…and 2889 more
Timeline
- Aug 13, 2026 CVE Published
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GO-2026-6088
vulnetix vdb fixes GO-2026-6088Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GO-2026-6088/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart