{"id":"CVE-2026-25680","aliases":["GHSA-5cv4-jp36-h3mw","GO-2026-5028"],"title":"Go Net HTML parser is vulnerable to denial of service","summary":"Go Net HTML parser is vulnerable to denial of service","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","vendor":"x","product":"golang.org/x/net","ecosystem":"go","affected":["golang.org/x/net < 0.55.0"],"patched":["golang.org/x/net 0.55.0"],"published":"2026-05-26","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:45.494180024Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-5cv4-jp36-h3mw","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25680"},{"url":"https://go.dev/cl/781702"},{"url":"https://go.dev/issue/79573"},{"url":"https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472"},{"url":"https://go.googlesource.com/net/+/refs/tags/v0.55.0"},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"},{"url":"https://pkg.go.dev/vuln/GO-2026-5028"},{"url":"cs.opensource.google/go/x/net"}],"tags":["osv","go"],"epss":0.00326,"epssPercentile":0.25985,"ingestedAt":"2026-09-12T03:13:01.755Z","slug":"CVE-2026-25680","body":"## Overview\n\nIn Go Net (`golang.org/x/net`) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.\n\n## Affected packages\n\n- `golang.org/x/net < 0.55.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `golang.org/x/net 0.55.0`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}