CVE-2025-47911 Quadratic parsing complexity in golang.org/x/net/html
Attackers can cause denial of service by providing specially crafted HTML content to the Go HTML parser due to quadratic parsing complexity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-47911?
CVE-2025-47911 is a medium-severity denial of service vulnerability in golang.org/x/net/html, published on 5 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
Which versions are affected by CVE-2025-47911?
3 open source packages ship an affected version, including golang.org/x/net/html and golang.org/x/net. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/net/html Go | All versions | 0.45.0 |
golang.org/x/net/html Go | All versions | 0.45.0 |
golang.org/x/net Go | All versions | 0.45.0 |
Linux distribution packages (3)
gomuks openSUSE:Tumbleweed | All versions | 0.3.1-2.1 |
ollama openSUSE:Tumbleweed | All versions | 0.12.6-1.1 |
v2ray-core openSUSE:Tumbleweed | All versions | 5.40.0-1.1 |
Products include Go Html.
How do I fix CVE-2025-47911?
Upgrade golang.org/x/net/html to 0.45.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-47911 being exploited?
There is no known exploitation of CVE-2025-47911 in the wild and no public exploit code.
Other vulnerabilities in golang.org/x/net/html
Sources
Also known as AZL-76778, AZL-76781, AZL-76784, AZL-76793, AZL-76796, AZL-76802 and 572 more.