GO-2026-4440

Quadratic parsing complexity in golang.org/x/net/html

At a glance

Published: 2026-02-05 17:23 UTC
Updated: 2026-05-15 10:59 UTC
CVE: CVE-2025-47911
Aliases: GHSA-w4gw-w5jq-g9jh

Description

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Affected packages

Package	Versions
Go · golang.org/x/net	introduced 0, fixed 0.45.0

References

https://go.dev/cl/709876 FIX
https://github.com/golang/vulndb/issues/4440 REPORT
https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database