---
id: CVE-2026-25680
aliases:
  - GHSA-5cv4-jp36-h3mw
  - GO-2026-5028
title: Go Net HTML parser is vulnerable to denial of service
summary: Go Net HTML parser is vulnerable to denial of service
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
vendor: x
product: golang.org/x/net
ecosystem: go
affected:
  - golang.org/x/net < 0.55.0
patched:
  - golang.org/x/net 0.55.0
published: '2026-05-26'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:45.494180024Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5cv4-jp36-h3mw'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25680'
  - url: 'https://go.dev/cl/781702'
  - url: 'https://go.dev/issue/79573'
  - url: 'https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472'
  - url: 'https://go.googlesource.com/net/+/refs/tags/v0.55.0'
  - url: 'https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8'
  - url: 'https://pkg.go.dev/vuln/GO-2026-5028'
  - url: cs.opensource.google/go/x/net
tags:
  - osv
  - go
epss: 0.00326
epssPercentile: 0.25985
ingestedAt: '2026-09-12T03:13:01.755Z'
---

## Overview

In Go Net (`golang.org/x/net`) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

## Affected packages

- `golang.org/x/net < 0.55.0`

## Remediation

Upgrade to a patched release:

- `golang.org/x/net 0.55.0`