Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-25680

Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

golang.org/x/net golang.org/x/net/html

Default version status: unaffected

  • 0 to < 0.55.0affected

References