CVE-2025-58190

Infinite parsing loop in golang.org/x/net

Medium · published February 5, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00548 · 45.1th percentile
Published
2026-02-05T17:48Z
EPSS history
Timeline
  • 05 FEB 17:48Z
    Infinite parsing loop in golang.org/x/net
    cvelistv5