5.3
Medium
CVE-2025-58190 The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which…
Description
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/net/html 0.45 | earliest → < 0.45.0 | 0.45.0 |
References
- groups.google.com groups.google.com
- github.com github.com
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of golang.org/x/net/html
The 12 CVEs of golang.org/x/net/html →
CVE-2026-78661
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
7.5
High
CVE-2026-97045
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
6.1
Medium
CVE-2026-27136
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
6.1
Medium
CVE-2026-25680
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
6.5
Medium