Repository navigation
x/net/html: denial of service when parsing arbitrary HTML #79573
Description
Due to the use of a cubic complexity algorithm during the HTML tree construction
stage, parsing arbitrary HTML can consume excessive CPU time.
Thanks to IPC Labs for reporting this issue.
This is CVE-2026-25680 and Go issue https://go.dev/issue/79573.
This was a PRIVATE track issue, tracked in http://b/483161460.
Activity
[-]security: fix CVE-2026-25680[/-][+]html: denial of service when parsing arbitrary HTML[/+][-]html: denial of service when parsing arbitrary HTML[/-][+]x/net/html: denial of service when parsing arbitrary HTML[/+]upgraded golang.org/x/net v0.53.0 => v0.55.0
upgraded golang.org/x/net v0.53.0 => v0.55.0
Upgrade `golang.org/x/` dependencies to address vulnerabilities (#311)