Описание
Go Net HTML parser is vulnerable to denial of service
In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2026-25680
- https://go.dev/cl/781702
- https://go.dev/issue/79573
- https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472
- https://go.googlesource.com/net/+/refs/tags/v0.55.0
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
- https://pkg.go.dev/vuln/GO-2026-5028
Пакеты
Наименование
golang.org/x/net
go
Затронутые версииВерсия исправления
< 0.55.0
0.55.0
Связанные уязвимости
CVSS3: 6.5
ubuntu
3 месяца назад
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
CVSS3: 6.5
redhat
3 месяца назад
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
CVSS3: 6.5
nvd
3 месяца назад
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
CVSS3: 6.5
msrc
2 месяца назад
Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
CVSS3: 6.5
debian
3 месяца назад
Parsing arbitrary HTML can consume excessive CPU time, possibly leadin ...