Quick answers
- Is CVE-2026-78661 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78661 being exploited in the wild.
- How severe is CVE-2026-78661?
- Informational severity, published 27 October 2026.
- Which products and versions are affected?
- golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.62.0.
- Is there a fix for CVE-2026-78661?
- Yes. golang.org/x/net (Go): upgrade to 0.62.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78661 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78661?
- Check whether you run golang.org/x/net (Go) or golang.org/x/net/html (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- golang.org/x/net (Go): upgrade to 0.62.0 or later
go get golang.org/x/net@v0.62.0
Technical details
The vulnerability exists in the addText and fosterParent functions of Go's HTML parser, which concatenate text via string concatenation (n.Data += text), causing O(n²) allocations and byte copies when handling many short text runs separated by ignored end tags. An attacker can craft HTML input with patterns like "a</x>" repeated many times to trigger quadratic time complexity in parsing. The issue affects the golang.org/x/net/html package; a fix materializes coalesced text in per-node byte slices instead of reallocating on each append.
Affected products
- Go golang.org/x/net/html
Identifiers
- CVE-2026-78661
- GO-2026-6860