~ / search / GHSA-5cv4-jp36-h3mw

GHSA-5cv4-jp36-h3mw

Go Net HTML parser is vulnerable to denial of service

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-25680

Packages

EcosystemPackageAffectedFixed in
Go golang.org/x/net < 0.55.0 0.55.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Go Net (`golang.org/x/net`) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

References

External links from the advisory. They lead to third-party sites.