CVE-2025-47911
MediumSummary
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity for specially crafted HTML inputs, which can lead to denial of service (DoS).
Risk Assessment
An attacker can exploit this vulnerability to overload a server or application by providing malicious HTML, causing service unavailability for legitimate users.
Recommendation
It is recommended to update the golang.org/x/net/html package to the latest patched version and limit processing of untrusted HTML data.
Other vulnerabilities in golang.org/x/net/html
See all- CVE-2025-22872Medium
The tokenizer incorrectly interprets tags with unquoted attribute values ending with a solidus character (/) as self-closing. When directly using Tokenizer, this can incorrectly mark such tags as self-closing, and when using Parse functions, content following such tags may be placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g., <math>, <svg> contexts).
- CVE-2025-58190Medium
The html.Parse function in the golang.org/x/net/html package enters an infinite loop when processing specially crafted HTML input. An attacker can exploit this vulnerability to cause a denial of service (DoS).
Original NVD description (English source)
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS