{"id":"CVE-2026-78661","kind":"vulnerability","aliases":["CVE-2026-78661","GO-2026-6860"],"related":[],"title":"Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net","description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","summary":"The golang.org/x/net HTML parser rebuilds an accumulated text node string on every token when adjacent text is merged, so crafted input with many small text runs separated by ignored end tags takes quadratic time and memory. An attacker can use this to make a service that parses untrusted HTML slow or resource-hungry.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"golang.org/x/net","fixed":["0.62.0"],"affected":"< 0.62.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","golang.org/x/net","package","self-hosted"],"not_affected_if":["no-html-parsing","trusted-input-only"],"how_to_check":"- Run `go list -m golang.org/x/net` in the project to see the version in use\n- Run `go version -m <binary> | grep golang.org/x/net` on built binaries","fix":"- Upgrade golang.org/x/net to `0.62.0` or later","status":"open","published_at":"2026-10-27T21:16:18+00:00","first_seen_at":"2026-10-27T22:19:32+00:00","triaged_at":"2026-10-27T22:19:53+00:00","updated_at":"2026-10-27T22:19:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T22:19:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade golang.org/x/net to `0.62.0` or later","reach":"internet","title":"Go x/net html parser: quadratic slowdown on many short text runs","impact":"low","summary":"The golang.org/x/net HTML parser rebuilds an accumulated text node string on every token when adjacent text is merged, so crafted input with many small text runs separated by ignored end tags takes quadratic time and memory. An attacker can use this to make a service that parses untrusted HTML slow or resource-hungry.","category":"package","nicknames":[],"who_cares":["go","golang.org/x/net","self-hosted"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Parser CPU and memory consumption grows quadratically, causing denial of service","analyst_note":"","how_to_check":"- Run `go list -m golang.org/x/net` in the project to see the version in use\n- Run `go version -m <binary> | grep golang.org/x/net` on built binaries","needs_analyst":false,"not_affected_if":["trusted-input-only","no-html-parsing"],"who_is_affected":"Services that parse untrusted HTML with golang.org/x/net/html, such as sanitizers, scrapers, or rendering pipelines that accept user-supplied markup. Programs that only parse trusted HTML or do not use the html package can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000589,"input_tokens":3387,"output_tokens":501,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A,21A '-6860':19A '-78661':16A,22A '/x/net':13A,25A,29B,37B '2':137C 'accumul':42B,115C,142C 'addtext':96C 'adjac':50B,92C 'alloc':138C 'append':99C 'attack':73B 'avoid':1A 'byte':140C,149C 'caus':134C 'coalesc':5A,91C,143C 'complex':3A 'concaten':108C 'contain':121C 'copi':113C,141C 'craft':55B 'cve':14A,20A 'data':105C,155C 'end':65B,129C,160C 'everi':47B,118C 'exist':102C 'fosterpar':98C 'go':17A,26B 'golang.org':12A,24A,28B,36B 'golang.org/x/net':11A,23A,27B,35B 'host':33B 'html':9A,38B,84B 'hungri':89B 'ignor':64B,128C 'input':56B,120C 'make':78B 'mani':58B,122C 'materi':154C 'memori':71B 'merg':53B 'n':136C 'n.data':109C 'node':7A,44B,94C,148C 'o':135C 'packag':30B 'pars':82B,152C,162C 'parser':39B 'per':147C 'per-nod':146C 'quadrat':2A,68B 'realloc':111C 'rebuild':40B 'resourc':88B 'resource-hungri':87B 'run':61B,125C 'self':32B 'self-host':31B 'separ':62B,126C 'servic':80B 'short':123C 'slice':150C 'slow':85B 'small':59B 'string':45B,107C,116C,156C 'tag':66B,130C 'take':67B 'text':6A,43B,51B,60B,93C,110C,124C,144C 'textnod':103C 'time':69B 'token':48B,119C 'untrust':83B 'use':75B 'via':106C","nicknames":[],"mitigations":[],"who_affected":"Services that parse untrusted HTML with golang.org/x/net/html, such as sanitizers, scrapers, or rendering pipelines that accept user-supplied markup. Programs that only parse trusted HTML or do not use the html package can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T21:16:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6860","url":"https://pkg.go.dev/vuln/GO-2026-6860","severity":null,"published_at":"2026-10-27T21:16:18+00:00","modified_at":"2026-10-27T21:16:18+00:00","first_seen_at":"2026-10-27T22:19:32+00:00","fetched_at":"2026-10-27T22:19:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-78661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","severity":null,"published_at":"2026-10-27T22:18:05+00:00","modified_at":"2026-10-27T22:18:05+00:00","first_seen_at":"2026-10-27T22:29:29+00:00","fetched_at":"2026-10-27T22:29:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}