7.5 High

CVE-2026-78661 Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

Description

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
golang.org/x/net/html 0.62	earliest → < 0.62.0	0.62.0

References

go.dev go.dev
go.dev go.dev
groups.google.com groups.google.com
pkg.go.dev pkg.go.dev

Timeline

Published October 27, 2026
Last modified November 4, 2026

The 12 CVEs of golang.org/x/net/html →

CVE-2026-97045 Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net 6.1 Medium CVE-2026-27136 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree 6.1 Medium CVE-2026-42506 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree 6.1 Medium CVE-2026-42502 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree 6.1 Medium

Track this CVE