---
id: CVE-2026-25681
aliases:
  - GO-2026-5029
title: >-
  Invoking incorrect handling of character references in DOCTYPE nodes in
  golang.org/x/net/html
summary: >-
  Invoking incorrect handling of character references in DOCTYPE nodes in
  golang.org/x/net/html
severity: none
vendor: x
product: golang.org/x/net
ecosystem: go
affected:
  - golang.org/x/net < 0.55.0
patched:
  - golang.org/x/net 0.55.0
published: '2026-05-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T10:41:48.499970547Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5029'
references:
  - url: 'https://go.dev/issue/79574'
  - url: 'https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8'
  - url: 'https://go.dev/cl/781703'
tags:
  - osv
  - go
epss: 0.00223
epssPercentile: 0.11561
ingestedAt: '2026-07-09T18:56:37.041Z'
---

## Overview

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

## Affected packages

- `golang.org/x/net < 0.55.0`

## Remediation

Upgrade to a patched release:

- `golang.org/x/net 0.55.0`