CVE-2026-25680: Go Net HTML parser is vulnerable to denial of service
(updated )
In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
References
- github.com/advisories/GHSA-5cv4-jp36-h3mw
- go.dev/cl/781702
- go.dev/issue/79573
- go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472
- go.googlesource.com/net/+/refs/tags/v0.55.0
- groups.google.com/g/golang-announce/c/iI-mYSI0lu8
- nvd.nist.gov/vuln/detail/CVE-2026-25680
- pkg.go.dev/vuln/GO-2026-5028
Code Behaviors & Features
Detect and mitigate CVE-2026-25680 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →