CVE-2026-25680 Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

Medium 6.5 Published 22 May 2026 Updated 22 May 2026

Attackers can cause denial of service by providing malicious HTML that consumes excessive CPU resources during parsing.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-25680?

CVE-2026-25680 is a medium-severity denial of service vulnerability in golang.org/x/net/html, published on 22 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Weakness: CWE-400

Which versions are affected by CVE-2026-25680?

3 open source packages ship an affected version, including golang.org/x/net. It affects 1 product.

Package	Affected	Fixed in
`golang.org/x/net` Go	All versions	`0.55.0`
`golang.org/x/net` Go	All versions	`0.55.0`
`golang.org/x/net` Go	All versions	`0.55.0`

Linux distribution packages (1)

amfora openSUSE:Tumbleweed All versions 1.11.0-3.1

Products include Golang Net.

How do I fix CVE-2026-25680?

Upgrade golang.org/x/net to 0.55.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-25680 being exploited?

There is no known exploitation of CVE-2026-25680 in the wild and no public exploit code.

Sources

Also known as AZL-87143, AZL-87242, AZL-87287, AZL-87338, AZL-87366, AZL-87414 and 1371 more.