Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-78661

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

Description

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

golang.org/x/net golang.org/x/net/html

Default version status: unaffected

  • 0 to < 0.62.0affected

References