CVE Catalog
CVE-2025-47911
MediumSummary
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity for specially crafted HTML inputs, which can lead to denial of service (DoS).
Risk Assessment
An attacker can exploit this vulnerability to overload a server or application by providing malicious HTML, causing service unavailability for legitimate users.
Recommendation
It is recommended to update the golang.org/x/net/html package to the latest patched version and limit processing of untrusted HTML data.
Original NVD description (English source)
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.