–
Not scored
CVE-2026-78661
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
golang.org/x/net/htmlAffectedgolang.org/x/net/html
FixUpdate to 0.62.0 or newer
PublishedOct 27, 21:38 · Go
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
From Go
Affected and fixed versions
ProductAffectedFixed ingolang.org/x/net/htmlbefore 0.62.00.62.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known