The vulnerability CVE-2026-56852 affects the golang.org/x/text library's norm.Iter component, which can enter an infinite loop when processing invalid UTF-8 input. This causes resource exhaustion resulting in a denial of service. The issue impacts Red Hat Hardened Images RPMs, including opentelemetry-collector-contrib version 0.157.0-0.1.hum1 on aarch64 and x86_64 architectures. Red Hat has published an advisory (RHSA-2026:43581) describing the issue and affected packages but currently does not provide a patch or fix that meets their criteria for deployment. The vulnerability has a high severity rating due to its potential to cause application unresponsiveness. The flaw is categorized under CWE-835 (Loop with Unreachable Exit Condition) and CWE-409.

The vulnerability can cause affected applications using the golang.org/x/text norm.Iter functionality to enter an infinite loop when processing specially crafted invalid UTF-8 input. This results in a denial of service condition due to resource exhaustion (CPU and memory), making the application unresponsive. There is no indication of confidentiality or integrity impact. No known active exploits have been reported.

Currently, no official fix or patch is available from Red Hat that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Since no mitigation is provided, affected users may consider upgrading to a future fixed version once available or consult Red Hat support for potential workarounds. Avoid processing untrusted input that could trigger the infinite loop where possible.