Name: CVE-2026-56859: Allocation of Resources Without Limits or Throttling
Creator: Rapid7
Published: 2026-08-13T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-56859, CWE-770, CVSS 7.5, EPSS 0.00483

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

CVSS Details

CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade criuUpgrade aardvark-dnsUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade podman-pluginsUpgrade golangUpgrade skopeoUpgrade podmanUpgrade criu-libsUpgrade containers-commonUpgrade skopeo-testsUpgrade criu-develUpgrade runcUpgrade libslirp-develUpgrade netavarkUpgrade podman-catatonitUpgrade golang-testsUpgrade delveUpgrade containernetworking-pluginsUpgrade golang-binUpgrade osbuild-composer-workerUpgrade golang-docsUpgrade grafana-selinuxUpgrade python3-criuUpgrade fuse-overlayfsUpgrade osbuild-composerUpgrade golang-srcUpgrade udicaUpgrade podman-remoteUpgrade conmonUpgrade golang-raceUpgrade libslirpUpgrade buildahUpgrade crunUpgrade golang-miscUpgrade grafanaUpgrade slirp4netnsUpgrade podman-testsUpgrade toolbox-testsUpgrade osbuild-composer-coreUpgrade buildah-testsUpgrade opentelemetry-collectorUpgrade go-toolsetUpgrade podman-dockerUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade python3-podmanUpgrade container-selinux	Oct 11, 2026	Aug 26, 2026
Alpine Linux	—	Upgrade go	Sep 7, 2026	Aug 13, 2026
Amazon Linux Ami 2	—	Upgrade golang-sharedUpgrade golang-miscUpgrade golang-srcUpgrade golang-docsUpgrade golang-testsUpgrade golangUpgrade golang-bin	Oct 19, 2026	Oct 19, 2026
Amazon_linux_2023	—	Upgrade golang-miscUpgrade golang-srcUpgrade golangUpgrade golang-sharedUpgrade golang-docsUpgrade golang-testsUpgrade golang-bin	Sep 1, 2026	Aug 13, 2026
Oracle_linux	—	Upgrade python3-criuUpgrade yggdrasil-develUpgrade critUpgrade golang-binUpgrade fuse-overlayfsUpgrade runcUpgrade buildahUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade buildah-testsUpgrade golangUpgrade containers-commonUpgrade ipp-usbUpgrade golang-miscUpgrade podman-remoteUpgrade osbuild-composerUpgrade osbuild-composer-coreUpgrade grafanaUpgrade criu-libsUpgrade golang-srcUpgrade aardvark-dnsUpgrade go-toolsetUpgrade container-selinuxUpgrade oci-seccomp-bpf-hookUpgrade golang-docsUpgrade podman-testsUpgrade skopeoUpgrade golang-raceUpgrade criu-develUpgrade udicaUpgrade python3-podmanUpgrade yggdrasilUpgrade podman-pluginsUpgrade libslirp-develUpgrade libslirpUpgrade podmanUpgrade crunUpgrade delveUpgrade criuUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade golang-testsUpgrade netavarkUpgrade grafana-selinuxUpgrade conmonUpgrade osbuild-composer-workerUpgrade yggdrasil-worker-package-managerUpgrade podman-dockerUpgrade podman-catatonitUpgrade skopeo-tests	Oct 22, 2026	Aug 13, 2026
Redhat Openshift	—	Upgrade microshiftUpgrade openshift-clientsUpgrade openshiftUpgrade ose-crio-credential-providerUpgrade ose-gcp-gcr-image-credential-providerUpgrade ose-azure-acr-image-credential-providerUpgrade cri-oUpgrade cri-toolsUpgrade ose-aws-ecr-image-credential-provider	Sep 16, 2026	Aug 13, 2026
Redhat_linux	—	Upgrade golang-docsUpgrade ipp-usb-debuginfoUpgrade crunUpgrade podman-pluginsUpgrade python3.12-gitpythonUpgrade receptor-debuginfoUpgrade toolbox-debugsourceUpgrade automation-eda-controller-baseUpgrade automation-platform-uiUpgrade buildah-debugsourceUpgrade podman-tests-debuginfoUpgrade receptor-debugsourceUpgrade cockpit-podmanUpgrade python3.12-django-ansible-base+channel_authUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3-podmanUpgrade flightctl-servicesUpgrade python3-sqlparseUpgrade ignition-debuginfoUpgrade conmonUpgrade container-selinuxUpgrade delve-debugsourceUpgrade skopeoUpgrade podman-catatonitUpgrade python3.12-django-ansible-base+authenticationUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade criu-libs-debuginfoUpgrade ipp-usbUpgrade yggdrasil-examples-debuginfoUpgrade automation-eda-controllerUpgrade podman-debugsourceUpgrade libslirp-debugsourceUpgrade osbuild-composer-dnf-jsonUpgrade python3.12-sqlparseUpgrade netavarkUpgrade golang-raceUpgrade yggdrasil-worker-package-manager-debuginfoUpgrade automation-gateway-proxyUpgrade criuUpgrade python3.12-galaxy-ngUpgrade skopeo-testsUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade grafana-debugsourceUpgrade toolbox-debuginfoUpgrade ignition-validateUpgrade toolboxUpgrade yggdrasilNo solution existsUpgrade ignition-debugsourceUpgrade libslirpUpgrade rhc-worker-playbook-debugsourceUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debuginfoUpgrade udicaUpgrade critUpgrade crun-debuginfoUpgrade automation-eda-controller-base-servicesUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade podman-dockerUpgrade fuse-overlayfs-debuginfoUpgrade slirp4netns-debugsourceUpgrade automation-controllerUpgrade python3.12-django-ansible-base+rest_filtersUpgrade automation-gateway-configUpgrade git-lfs-debugsourceUpgrade image-builder-debuginfoUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade automation-gateway-proxy-debugsourceUpgrade automation-gateway-proxy-serverUpgrade osbuild-composer-workerUpgrade delveUpgrade toolbox-testsUpgrade slirp4netnsUpgrade flightctl-observabilityUpgrade podman-catatonit-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-testsUpgrade flightctl-agentUpgrade python3.12-django-ansible-base+rbacUpgrade grafana-debuginfoUpgrade image-builderUpgrade runcUpgrade golang-srcUpgrade automation-gateway-serverUpgrade fuse-overlayfsUpgrade receptorUpgrade automation-controller-venv-towerUpgrade automation-controller-cliUpgrade podman-remoteUpgrade opentelemetry-collectorUpgrade yggdrasil-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade yggdrasil-worker-package-manager-debugsourceUpgrade automation-eda-controller-worker-servicesUpgrade python3.12-django-ansible-base+activitystreamUpgrade python3.12-django-ansible-baseUpgrade python3.12-django-ansible-base+api_documentationUpgrade buildah-testsUpgrade golang-binUpgrade fuse-overlayfs-debugsourceUpgrade podmanUpgrade conmon-debuginfoUpgrade osbuild-composer-coreUpgrade go-toolsetUpgrade conmon-debugsourceUpgrade yggdrasil-worker-package-managerUpgrade buildah-debuginfoUpgrade yggdrasil-develUpgrade flightctl-selinuxUpgrade yggdrasil-debuginfoUpgrade runc-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade image-builder-debugsourceUpgrade grafana-selinuxUpgrade golangUpgrade buildahUpgrade containernetworking-pluginsUpgrade python3.12-django-ansible-base+feature_flagsUpgrade grafanaUpgrade criu-libsUpgrade golang-miscUpgrade libslirp-develUpgrade python3.12-django-ansible-base+redis_clientUpgrade receptorctlUpgrade automation-hubUpgrade rhc-worker-playbookUpgrade delve-debuginfoUpgrade python3.12-django-ansible-base+resource_registryUpgrade ignition-grubUpgrade automation-gateway-proxy-server-debuginfoUpgrade automation-gatewayUpgrade podman-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade criu-debugsourceUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade buildah-tests-debuginfoUpgrade containers-commonUpgrade flightctl-cliUpgrade automation-controller-serverUpgrade aap-metrics-utilityUpgrade ignition-edgeUpgrade python3-criuUpgrade podman-gvproxy-debuginfoUpgrade criu-debuginfoUpgrade aardvark-dnsUpgrade libslirp-debuginfoUpgrade ignition-validate-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade runc-debugsourceUpgrade rhc-worker-playbook-debuginfoUpgrade golang-testsUpgrade automation-eda-controller-event-stream-servicesUpgrade automation-controller-uiUpgrade osbuild-composerUpgrade git-lfs-debuginfoUpgrade git-lfsUpgrade crun-debugsourceUpgrade ignition	Aug 17, 2026	Aug 13, 2026
Rocky_linux	—	Upgrade buildah-debugsourceUpgrade criu-libs-debuginfoUpgrade podman-plugins-debuginfoUpgrade ipp-usb-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade golang-binUpgrade runcUpgrade toolbox-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-debuginfoUpgrade delveUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debuginfoUpgrade osbuild-composer-workerUpgrade osbuild-composer-debugsourceUpgrade crunUpgrade image-builderUpgrade libslirp-debugsourceUpgrade podman-catatonitUpgrade image-builder-debuginfoUpgrade podman-pluginsUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade grafana-debugsourceUpgrade critUpgrade python3-criuUpgrade runc-debugsourceUpgrade podman-tests-debuginfoUpgrade buildahUpgrade podman-debugsourceUpgrade opentelemetry-collectorUpgrade criu-debugsourceUpgrade skopeoUpgrade toolbox-testsUpgrade osbuild-composer-worker-debuginfoUpgrade podman-catatonit-debuginfoUpgrade osbuild-composerUpgrade grafana-debuginfoUpgrade delve-debugsourceUpgrade podmanUpgrade fuse-overlayfsUpgrade grafana-selinuxUpgrade buildah-testsUpgrade criuUpgrade toolbox-debuginfoUpgrade golang-raceUpgrade slirp4netnsUpgrade criu-develUpgrade ipp-usbUpgrade libslirp-develUpgrade containernetworking-plugins-debugsourceUpgrade grafanaUpgrade buildah-debuginfoUpgrade osbuild-composer-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade golangUpgrade fuse-overlayfs-debugsourceUpgrade criu-debuginfoUpgrade conmonUpgrade go-toolsetUpgrade podman-remote-debuginfoUpgrade skopeo-testsUpgrade netavarkUpgrade libslirpUpgrade conmon-debugsourceUpgrade conmon-debuginfoUpgrade buildah-tests-debuginfoUpgrade aardvark-dnsUpgrade image-builder-debugsourceUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade podman-testsUpgrade osbuild-composer-coreUpgrade runc-debuginfoUpgrade toolboxUpgrade crun-debugsourceUpgrade crun-debuginfoUpgrade podman-gvproxyUpgrade osbuild-composer-core-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade delve-debuginfoUpgrade criu-libsUpgrade containers-common	Aug 28, 2026	Aug 26, 2026
Ubuntu	—	Upgrade golang-1.22-goUpgrade golang-1.22Upgrade golang-1.22-src	Oct 19, 2026	Aug 13, 2026
Vmware Photon_os	—	Use 'tdnf update' to upgrade all packages to the latest version.	Sep 15, 2026	Aug 13, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence