CVE-2025-47911

Quadratic parsing complexity in golang.org/x/net/html

Medium · published February 5, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
46.4
In the wild
Unconfirmed
What it is

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00570 · 46.4th percentile
Published
2026-02-05T17:48Z
EPSS history
Timeline
  • 05 FEB 17:48Z
    Quadratic parsing complexity in golang.org/x/net/html
    cvelistv5