medium6.5
CVE-2026-25680
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
Impact
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | golang.org/x/net | < 0.55.0 | 0.55.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Golang | Net | before 0.55.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-5cv4-jp36-h3mw
- https://nvd.nist.gov/vuln/detail/CVE-2026-25680
- https://go.dev/cl/781702
- https://go.dev/issue/79573
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
- https://pkg.go.dev/vuln/GO-2026-5028
- https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472
- https://go.googlesource.com/net/+/refs/tags/v0.55.0