Name: CVE-2026-56859: Allocation of Resources Without Limits or Throttling
Creator: Rapid7
Published: 2026-08-13T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-56859, CWE-770, CVSS 7.5, EPSS 0.00568

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

CVSS Details

CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade toolboxUpgrade python3-criuUpgrade osbuild-composerUpgrade fuse-overlayfsUpgrade golang-docsUpgrade runcUpgrade libslirp-develUpgrade podmanUpgrade skopeo-testsUpgrade podman-catatonitUpgrade golang-binUpgrade podman-pluginsUpgrade osbuild-composer-workerUpgrade delveUpgrade udicaUpgrade aardvark-dnsUpgrade critUpgrade grafana-selinuxUpgrade golang-srcUpgrade netavarkUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade skopeoUpgrade golang-testsUpgrade criu-develUpgrade podman-remoteUpgrade oci-seccomp-bpf-hookUpgrade golangUpgrade containers-commonUpgrade criuUpgrade golang-miscUpgrade conmonUpgrade container-selinuxUpgrade cockpit-podmanUpgrade python3-podmanUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade golang-raceUpgrade crunUpgrade toolbox-testsUpgrade osbuild-composer-coreUpgrade podman-dockerUpgrade buildahUpgrade podman-testsUpgrade opentelemetry-collectorUpgrade buildah-testsUpgrade go-toolsetUpgrade libslirpUpgrade grafana	Oct 11, 2026	Aug 26, 2026
Alpine Linux	—	Upgrade go	Sep 7, 2026	Aug 13, 2026
Amazon Linux Ami 2	—	Upgrade golang-miscUpgrade golang-srcUpgrade golang-sharedUpgrade golang-docsUpgrade golang-binUpgrade golangUpgrade golang-tests	Oct 19, 2026	Oct 19, 2026
Amazon_linux_2023	—	Upgrade golang-srcUpgrade golangUpgrade golang-miscUpgrade golang-sharedUpgrade golang-testsUpgrade golang-binUpgrade golang-docs	Sep 1, 2026	Aug 13, 2026
Redhat Openshift	—	Upgrade openshiftUpgrade openshift-clientsUpgrade microshiftUpgrade ose-crio-credential-providerUpgrade cri-oUpgrade ose-azure-acr-image-credential-providerUpgrade ose-aws-ecr-image-credential-providerUpgrade ose-gcp-gcr-image-credential-providerUpgrade cri-tools	Sep 16, 2026	Aug 13, 2026
Redhat_linux	—	Upgrade runcUpgrade git-lfsUpgrade git-lfs-debuginfoUpgrade osbuild-composer-coreUpgrade image-builderUpgrade runc-debuginfoUpgrade osbuild-composerUpgrade crun-debugsourceUpgrade python3.12-django-ansible-base+api_documentationUpgrade automation-eda-controller-worker-servicesUpgrade podmanUpgrade python3.12-django-ansible-base+activitystreamUpgrade fuse-overlayfs-debugsourceUpgrade golang-srcUpgrade oci-seccomp-bpf-hookUpgrade image-builder-debugsourceUpgrade criu-debugsourceUpgrade yggdrasil-worker-package-managerUpgrade containers-commonUpgrade yggdrasil-worker-package-manager-debugsourceUpgrade buildah-testsUpgrade yggdrasil-debuginfoUpgrade python3.12-django-ansible-baseUpgrade aap-metrics-utilityUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade aardvark-dnsUpgrade libslirp-develUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade automation-controller-serverUpgrade yggdrasil-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade yggdrasil-develUpgrade golang-miscUpgrade rhc-worker-playbook-debuginfoUpgrade buildahUpgrade flightctl-cliUpgrade automation-hubUpgrade automation-eda-controller-event-stream-servicesUpgrade automation-gateway-serverUpgrade automation-controller-uiUpgrade fuse-overlayfsUpgrade grafana-debuginfoUpgrade podman-remoteUpgrade runc-debugsourceUpgrade golang-testsUpgrade grafanaUpgrade opentelemetry-collectorUpgrade automation-controller-cliUpgrade ignitionUpgrade receptorUpgrade buildah-tests-debuginfoUpgrade python3.12-django-ansible-base+feature_flagsUpgrade golangUpgrade receptorctlUpgrade go-toolsetUpgrade containernetworking-pluginsUpgrade golang-binUpgrade buildah-debuginfoUpgrade flightctl-selinuxUpgrade criu-debuginfoUpgrade grafana-selinuxUpgrade conmon-debugsourceUpgrade conmon-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade python3-criuUpgrade ignition-edgeUpgrade rhc-worker-playbookUpgrade automation-gatewayUpgrade automation-gateway-proxy-server-debuginfoUpgrade libslirp-debuginfoUpgrade podman-debuginfoUpgrade ignition-validate-debuginfoUpgrade python3.12-django-ansible-base+redis_clientUpgrade ignition-grubUpgrade python3.12-django-ansible-base+resource_registryUpgrade automation-controller-venv-towerUpgrade criu-libsUpgrade delve-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade flightctl-servicesUpgrade podman-tests-debuginfoUpgrade podman-testsUpgrade podman-dockerUpgrade podman-catatonitUpgrade osbuild-composer-worker-debuginfoUpgrade conmonUpgrade receptor-debugsourceUpgrade libslirp-debugsourceUpgrade toolbox-debuginfoNo solution existsUpgrade osbuild-composer-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade automation-gateway-configUpgrade automation-gateway-proxy-debugsourceUpgrade slirp4netns-debugsourceUpgrade flightctl-agentUpgrade automation-controllerUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade git-lfs-debugsourceUpgrade image-builder-debuginfoUpgrade python3.12-sqlparseUpgrade criuUpgrade netavarkUpgrade ipp-usbUpgrade ignition-debuginfoUpgrade toolbox-testsUpgrade automation-gateway-proxy-serverUpgrade python3-podmanUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3.12-django-ansible-base+channel_authUpgrade podman-catatonit-debuginfoUpgrade delveUpgrade podman-gvproxyUpgrade critUpgrade automation-eda-controller-base-servicesUpgrade crun-debuginfoUpgrade libslirpUpgrade osbuild-composer-debugsourceUpgrade automation-gateway-proxyUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade criu-libs-debuginfoUpgrade criu-develUpgrade containernetworking-plugins-debugsourceUpgrade ignition-debugsourceUpgrade python3.12-galaxy-ngUpgrade buildah-debugsourceUpgrade golang-raceUpgrade python3.12-django-ansible-base+rbacUpgrade rhc-worker-playbook-debugsourceUpgrade automation-eda-controllerUpgrade toolbox-debugsourceUpgrade grafana-debugsourceUpgrade slirp4netnsUpgrade yggdrasil-examples-debuginfoUpgrade podman-pluginsUpgrade crunUpgrade udicaUpgrade skopeoUpgrade automation-platform-uiUpgrade toolboxUpgrade golang-docsUpgrade receptor-debuginfoUpgrade skopeo-testsUpgrade ignition-validateUpgrade yggdrasil-worker-package-manager-debuginfoUpgrade container-selinuxUpgrade ipp-usb-debuginfoUpgrade python3-sqlparseUpgrade delve-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python3.12-gitpythonUpgrade slirp4netns-debuginfoUpgrade podman-debugsourceUpgrade automation-eda-controller-baseUpgrade python3.12-django-ansible-base+authenticationUpgrade osbuild-composer-workerUpgrade flightctl-observabilityUpgrade cockpit-podmanUpgrade yggdrasil	Aug 17, 2026	Aug 13, 2026
Rocky_linux	—	Upgrade grafana-debuginfoUpgrade buildah-debugsourceUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composerUpgrade skopeoUpgrade critUpgrade libslirp-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade image-builder-debuginfoUpgrade crunUpgrade podman-remoteUpgrade grafana-debugsourceUpgrade podman-catatonitUpgrade image-builderUpgrade grafana-selinuxUpgrade podmanUpgrade criuUpgrade podman-catatonit-debuginfoUpgrade containernetworking-pluginsUpgrade podman-debuginfoUpgrade delveUpgrade toolbox-debuginfoUpgrade delve-debugsourceUpgrade buildah-testsUpgrade python3-criuUpgrade buildahUpgrade golang-binUpgrade podman-plugins-debuginfoUpgrade toolbox-testsUpgrade podman-tests-debuginfoUpgrade runc-debugsourceUpgrade libslirp-debuginfoUpgrade podman-debugsourceUpgrade toolbox-debugsourceUpgrade criu-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade slirp4netns-debuginfoUpgrade criu-libs-debuginfoUpgrade podman-pluginsUpgrade fuse-overlayfsUpgrade osbuild-composer-workerUpgrade osbuild-composer-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade runcUpgrade ipp-usb-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade opentelemetry-collectorUpgrade criu-libsUpgrade buildah-debuginfoUpgrade slirp4netnsUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade osbuild-composer-coreUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade podman-gvproxyUpgrade osbuild-composer-core-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade delve-debuginfoUpgrade containers-commonUpgrade runc-debuginfoUpgrade skopeo-testsUpgrade netavarkUpgrade libslirpUpgrade conmon-debugsourceUpgrade conmon-debuginfoUpgrade buildah-tests-debuginfoUpgrade aardvark-dnsUpgrade podman-remote-debuginfoUpgrade image-builder-debugsourceUpgrade golang-github-openprinting-ipp-usb-debugsourceUpgrade podman-testsUpgrade go-toolsetUpgrade conmonUpgrade criu-develUpgrade ipp-usbUpgrade libslirp-develUpgrade crun-debugsourceUpgrade crun-debuginfoUpgrade toolboxUpgrade osbuild-composer-debuginfoUpgrade grafanaUpgrade golang-raceUpgrade golang	Aug 28, 2026	Aug 26, 2026
Ubuntu	—	Upgrade golang-1.22	Oct 19, 2026	Aug 13, 2026
Vmware Photon_os	—	Use 'tdnf update' to upgrade all packages to the latest version.	Sep 15, 2026	Aug 13, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business