GitHub Advisoryadvisory · Go
GHSA-5cv4-jp36-h3mw Go Net HTML parser is vulnerable to denial of service
MEDIUM
Official page ↗
- Aliases
- CVE-2026-25680
- Ecosystem
- Go
- Packages
- golang.org/x/net
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2026-07-01
Affected packages
• Go golang.org/x/net: < 0.55.0 → fixed in 0.55.0
Description
In Go Net (`golang.org/x/net`) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
Related
Alias · CVE (1)
- CVE-2026-25680 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-25680 advisory
- https://go.dev/cl/781702 web
- https://go.dev/issue/79573 web
- https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472 web
- https://go.googlesource.com/net/+/refs/tags/v0.55.0 web
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 web
- https://pkg.go.dev/vuln/GO-2026-5028 web
- cs.opensource.google/go/x/net package