{"id":"CVE-2026-56851","published":"2026-10-07T18:17:20.903","lastModified":"2026-10-08T21:35:53.890","description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://go.dev/cl/793360","tags":[]},{"url":"https://go.dev/issue/80112","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6629","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The vulnerability is an out-of-bounds slice error in the Nickname profile transformation logic that can cause a panic when processing crafted input into a short destination buffer. This allows an attacker to trigger a denial of service condition without requiring authentication or user interaction.","exploitability":"Exploitation is moderately difficult as it requires crafting specific input that triggers the out-of-bounds slice error, but does not require authentication or complex preconditions.","blast_radius":"The impact is limited to causing a panic and denial of service for the affected service, with no data exposure or persistence, though multiple concurrent attacks could potentially overwhelm the system.","remediation":"No fixed version is published. Disable the Nickname profile transformation feature until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","panic","buffer-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:03:14.456Z"}}