CVE-2025-47911

Description

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.52%• Percentile: 43%

Affected Systems

• chainguard•addon-resizer

  < 0

• chainguard•addon-resizer-fips

  < 0

• chainguard•amazon-ecs-agent

  < 0

• chainguard•amazon-ecs-agent-fips

  < 0

• chainguard•amazon-k8s-cni-init-fips-compat

  < 0

• chainguard•ansible-operator

  < 0

• chainguard•ansible-operator-fips

  < 0

• chainguard•apm-server-9.0

  < 0

• chainguard•apm-server-fips-8.18

  < 0

• chainguard•apm-server-fips-9.0

  < 0

• chainguard•auditbeat-fips-8.17

  < 0

• chainguard•auditbeat-fips-8.18

  < 0

• chainguard•auditbeat-fips-9.0

  < 0

• chainguard•aws-application-networking-k8s

  < 0

• chainguard•aws-application-networking-k8s-fips

  < 0

• chainguard•aws-ebs-csi-driver-1.49

  all

• chainguard•aws-ebs-csi-driver-1.50

  < 0

• chainguard•aws-ebs-csi-driver-fips-1.49

  all

• chainguard•aws-ebs-csi-driver-fips-1.50

  < 0

• chainguard•aws-efs-csi-driver

  < 0

• chainguard•aws-efs-csi-driver-fips

  < 0

• chainguard•aws-load-balancer-controller

  < 3.1.0-r1

• chainguard•aws-load-balancer-controller-fips

  < 0

• chainguard•aws-s3-controller

  < 0

• chainguard•backup-restore-operator-7.0

  < 7.0.6-r1

• chainguard•cass-operator

  < 0

• chainguard•cass-operator-fips

  < 0

• chainguard•cass-operator-fips-no-pvc-delete

  < 0

• chainguard•cert-manager-fips-1.17

  all

• chainguard•cilium-1.16-envoy

  all

• chainguard•cilium-envoy-1.16

  all

• chainguard•cilium-envoy-1.17

  < 1.17.13-r0

• chainguard•cilium-envoy-fips-1.15

  all

• chainguard•cilium-envoy-fips-1.16

  all

• chainguard•cilium-envoy-fips-1.17

  < 1.17.13-r0

• chainguard•cilium-fips-1.15

  < 0

• chainguard•cilium-fips-1.15-clustermesh-apiserver

  < 0

• chainguard•cilium-fips-1.15-host-utils

  < 0

• chainguard•cilium-fips-1.15-hubble-relay

  < 0

• chainguard•cilium-fips-1.15-operator-aws

  < 0

• chainguard•cilium-fips-1.15-operator-azure

  < 0

• chainguard•cilium-fips-1.15-operator-generic

  < 0

• chainguard•cis-operator-1.2

  < 0

• chainguard•cis-operator-1.3

  < 0

• chainguard•cloud-provider-aws-1.28-cloud-controller-manager

  < 0

• chainguard•cloud-provider-aws-1.28-ecr-credential-provider

  < 0

• chainguard•cloud-provider-aws-1.31-cloud-controller-manager

  < 0

• chainguard•cloud-provider-aws-1.31-ecr-credential-provider

  < 0

• chainguard•cloud-provider-aws-fips-1.28-cloud-controller-manager

  < 0

• chainguard•cloud-provider-aws-fips-1.28-ecr-credential-provider

  < 0

Showing first 50 affected entries in server-rendered view.

References (7)

• https://go.dev/cl/709876
• https://github.com/golang/vulndb/issues/4440
• https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c
• https://pkg.go.dev/vuln/GO-2026-4440
• https://nvd.nist.gov/vuln/detail/CVE-2025-47911
• https://go.googlesource.com/net
• https://security-tracker.debian.org/tracker/CVE-2025-47911