En resumen
- CVE-2026-78661 es una vulnerabilidad aún sin puntuar que afecta a golang.org/x/net.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.18%, mayor que el 8.1% de las vulnerabilidades.
- Solución: actualizar a 0.62.0 o posterior.
Description
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies.
Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
NVD description
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
Más vulnerabilidades de golang.org/x/net
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free