—

GO-2026-6088

Add recursion depth guard during decode in encoding/xml

Quick fix

GO-2026-6088 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.25.13

Details

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Enter the version of the package you're using.

Introduced in: 0 Fixed in: 1.25.13

Fix go get stdlib@v1.25.13