A critical vulnerability in the Go standard library encoding/xml package allows unauthenticated remote attackers to trigger stack exhaustion, resulting in a denial of service.

This vulnerability is a resource exhaustion issue (CWE-770) where the DecodeElement function fails to properly increment or track depth, allowing for uncontrolled recursion. The attack vector is network-based and requires no authentication from the attacker.

The ability for an unauthenticated attacker to cause stack exhaustion leads to a complete denial of service for applications utilizing the affected encoding/xml package. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to service availability, potentially impacting critical business operations that rely on XML data processing.

Immediate Action: Update the Go environment to a non-vulnerable version, specifically 1.25.13, 1.26.6, or 1.27.0-rc.3 or later, as specified by the Go security advisory.

Proactive Monitoring: Monitor application logs for sudden spikes in memory usage or crash reports related to stack overflow errors in XML parsing routines.

Compensating Controls: Implement input validation or size limits on incoming XML payloads at the network edge or application gateway to restrict the depth and complexity of submitted data.

Public Exploit Available: No

Organizations utilizing Go for XML processing should prioritize patching as soon as possible to prevent potential service disruptions. Given the ease of exploitation and the critical nature of the affected standard library, applying the vendor-provided updates is the only definitive way to mitigate the risk of stack exhaustion attacks.