CVE-2026-56859 Add recursion depth guard during decode in encoding/xml

[
  {
    "vendor": "Go standard library",
    "product": "encoding/xml",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "encoding/xml",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.25.13",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.26.0-0",
        "lessThan": "1.26.6",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.27.0-0",
        "lessThan": "1.27.0-rc.3",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "Decoder.push"
      },
      {
        "name": "Decoder.pop"
      },
      {
        "name": "Decoder.RawToken"
      },
      {
        "name": "Decoder.unmarshalPath"
      },
      {
        "name": "Decoder.unmarshal"
      },
      {
        "name": "Decoder.Decode"
      },
      {
        "name": "Decoder.DecodeElement"
      },
      {
        "name": "Decoder.Skip"
      },
      {
        "name": "Decoder.Token"
      },
      {
        "name": "Unmarshal"
      }
    ],
    "defaultStatus": "unaffected"
  }
]