Executive brief
A vulnerability in the Go programming language's standard networking library could allow an attacker to crash or slow down applications that process web content. By providing a specially crafted HTML file, an attacker can force the system to consume excessive processor resources, leading to a denial of service. This affects any Go-based service or tool that uses the affected library to parse HTML from external sources.
Technical details
A vulnerability in the Go Net (`golang.org/x/net`) HTML parser allows for uncontrolled resource consumption (CWE-400). When parsing arbitrary, malicious HTML input, the parser can be forced to consume excessive CPU time. The attack vector is network-based and requires no special privileges, though it is categorized as requiring user interaction (e.g., a user or service processing a malicious file). This can result in a sustained denial of service for the affected application. The issue is resolved in version 0.55.0 of the library.
Affected products
- Go x/net < 0.55.0
Timeline
- 2026-05-22: disclosed: NVD publication date
- 2026-05-26: advisory: GitHub Advisory published
- 2026-07-01: patched: GitHub Advisory reviewed and updated with patch information