Live › vulnerability › CVE-2026-78661
Go to dashboardThe golang.org/x/net HTML parser rebuilds an accumulated text node string on every token when adjacent text is merged, so crafted input with many small text runs separated by ignored end tags takes quadratic time and memory. An attacker can use this to make a service that parses untrusted HTML slow or resource-hungry.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 22:19 UTC, 0h before NVD. All times on this page are UTC.
Services that parse untrusted HTML with golang.org/x/net/html, such as sanitizers, scrapers, or rendering pipelines that accept user-supplied markup. Programs that only parse trusted HTML or do not use the html package can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| golang.org/x/net | go | < 0.62.0 | 0.62.0 |
go list -m golang.org/x/net in the project to see the version in usego version -m <binary> | grep golang.org/x/net on built binaries0.62.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies.
Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
This page as .md · .json · in your agent: get_signal("CVE-2026-78661")
Go Vulnerability Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.