DecodeElement in the Go standard library’s encoding/xml package resets the recursion depth counter during parsing, preventing the depth guard from ever firing. A crafted XML document with a deep chain of nested elements can therefore force the decoder to recurse until the process stack overflows, terminating or hanging the application. The result is an availability loss, classified as a denial‑of‑service condition.

The vulnerability exists in any Go release that contains the pre‑patch implementation of DecodeElement in the encoding/xml package. Because specific affected releases are not listed, any Go program that relies on the standard library decoder without the recursion depth guard may be vulnerable. The impact applies to all services or applications that decode untrusted XML data using this function.

The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% suggests a low likelihood of exploitation at present. Based on the description, it is inferred that an attacker could trigger the vulnerability remotely by sending crafted XML to a vulnerable service, as the decoder operates on user‑controlled input. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires no special privileges, making the remote attack vector straightforward for an adversary with network access to the target.