CVE-2025-47911

Quadratic parsing complexity in golang.org/x/net/html

Published Feb 5, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-w4gw-w5jq-g9jh golang.org/x/net/html has a Quadratic Parsing Complexity issue
Ubuntu USN Ubuntu USN USN-8089-1 Go Networking vulnerabilities
Ubuntu USN Ubuntu USN USN-8089-2 Go Networking vulnerabilities
Ubuntu USN Ubuntu USN USN-8089-3 ADSys, Juju Core, LXD vulnerabilities
Ubuntu USN Ubuntu USN USN-8900-1 Go Networking vulnerabilities
History
Type Values Removed Values Added
First Time appeared Go
Go html
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:go:html:*:*:*:*:*:go:*:*
Vendors & Products Go
Go html
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Weaknesses CWE-400
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Moderate

Type Values Removed Values Added
First Time appeared Golang
Golang net
Vendors & Products Golang
Golang net
Type Values Removed Values Added
Description The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
Title Quadratic parsing complexity in golang.org/x/net/html
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Feb 12, 2026, 3:23 PM
Reserved
May 13, 2025, 11:31 PM
Status
Analyzed
Published
Feb 5, 2026, 6:16 PM
Modified
Jun 17, 2026, 9:28 AM
Severity
Moderate
Public date
Feb 5, 2026, 5:48 PM