Launch Week Day 1: Announcing Security Design Review
MEDIUM 5.3 Go

golang.org/x/net/html has a Quadratic Parsing Complexity issue

GHSA-w4gw-w5jq-g9jh · CVE-2025-47911 · GO-2026-4440

Published · Modified

Description

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to Denial of Service (DoS) if an attacker provides specially crafted HTML content.

Ready to move

Start Securing

Free, no credit card | First findings in minutes