golang.org/x/net/html has a Quadratic Parsing Complexity issue

MEDIUM 5.3CVE-2025-47911 · GHSA-w4gw-w5jq-g9jh · GO-2026-4440 · Published 05/02/2026 · updated 17/06/2026

In short

CVE-2025-47911 is a MEDIUM (CVSS 5.3) vulnerability affecting golang.org/x/net, golang.org/x/net/html, html (go).
Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.7% of all vulnerabilities.
Fix: update to 0.45.0 or later.

Package	Affected versions	Patched versions
golang.org/x/net Go	`< 0.45.0`	`0.45.0`
golang.org/x/net/html Go	`< 0.45.0`	`0.45.0`
html go	`< 0.45.0`	`0.45.0`

Description

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to Denial of Service (DoS) if an attacker provides specially crafted HTML content.

NVD description

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

References

nvd.nist.gov/vuln/detail/CVE-2025-47911 · ADVISORY
golang/vulndb · WEB
go.dev/cl/709876 · WEB
go.googlesource.com/net · PACKAGE
groups.google.com/g/golang-announce/c/jnQcOYpiR2c · WEB
pkg.go.dev/vuln/GO-2026-4440 · WEB

More vulnerabilities in golang.org/x/net

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

golang.org/x/net

< 0.45.0

0.45.0

golang.org/x/net/html

< 0.45.0

0.45.0

html

< 0.45.0

0.45.0

Description

NVD description

More vulnerabilities in golang.org/x/net

See all →