CVE-2025-58190

Description

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

PUBLISHED Reserved 2025-08-27 | Published 2026-02-05 | Updated 2026-02-12 | Assigner Go

Problem types

CWE-835: Loop with Unreachable Exit Condition

Product status

Credits

Guido Vranken

References

groups.google.com/g/golang-announce/c/jnQcOYpiR2c

github.com/golang/vulndb/issues/4441

go.dev/cl/709875

pkg.go.dev/vuln/GO-2026-4441

cve.org (CVE-2025-58190)

nvd.nist.gov (CVE-2025-58190)

Download JSON