FlawAtlas
Search the atlas
CVE-2025-47911 Moderate

golang.org/x/net/html has a Quadratic Parsing Complexity issue

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to Denial of Service (DoS) if an attacker provides specially crafted HTML content.

Exploit probability 0.5%
Published February 12, 2026
Required by Not available
Last source change February 16, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown
Go golang.org/x/net
Go golang.org/x/net/html

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2026:21483-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities GO-2026-4440

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

View original source
Open Source Vulnerabilities GHSA-w4gw-w5jq-g9jh

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to Denial of Service (DoS) if an attacker provides specially crafted HTML content.

View original source
Open Source Vulnerabilities CVE-2025-47911

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

View original source

05 / REFERENCES

Further evidence