CVE-2025-47911: Quadratic parsing complexity in golang.org/x/net/html

Analyzed

AliasesUBUNTU-CVE-2025-47911DEBIAN-CVE-2025-47911CGA-234c-p2h4-pq99+1250 more

Published 05-02-2026Last modified 12-02-2026

Vulnerability summary

CVE-2025-47911 is a medium (CVSS 5.3) vulnerability in go html. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 46.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.56%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 73 · Related 76

OPENSUSE-RU-2026:20010-1 OPENSUSE-SU-2025:15607-1 OPENSUSE-SU-2025:15616-1 OPENSUSE-SU-2025:15617-1 OPENSUSE-SU-2025:15618-1 OPENSUSE-SU-2025:15619-1+70 more

Timeline

05-02-2026
PublishedVulnerability first disclosed.
12-02-2026
Last modifiedVulnerability information updated.

Description

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.3

EPSS trend

Probability

0.56%

Chance of exploitation in the next 30 days

Percentile

47%

Versus all other CVEs

30-day change

Decrease -0.01 pp

From 0.57% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

addon-resizerAll versions (No fix recorded)
addon-resizer-fipsAll versions (No fix recorded)
amazon-ecs-agentAll versions (No fix recorded)
amazon-ecs-agent-fipsAll versions (No fix recorded)
amazon-k8s-cni-init-fips-compatAll versions (No fix recorded)

ansible-operatorAll versions (No fix recorded)
ansible-operator-fipsAll versions (No fix recorded)
apm-server-9.0All versions (No fix recorded)
apm-server-fips-8.18All versions (No fix recorded)
apm-server-fips-9.0All versions (No fix recorded)
auditbeat-fips-8.17All versions (No fix recorded)
auditbeat-fips-8.18All versions (No fix recorded)
auditbeat-fips-9.0All versions (No fix recorded)
aws-application-networking-k8sAll versions (No fix recorded)
aws-application-networking-k8s-fipsAll versions (No fix recorded)
aws-ebs-csi-driver-1.49All versions (No fix recorded)
aws-ebs-csi-driver-1.50All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.49All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.50All versions (No fix recorded)
aws-efs-csi-driverAll versions (No fix recorded)
aws-efs-csi-driver-fipsAll versions (No fix recorded)
aws-load-balancer-controller< 3.1.0-r1
aws-load-balancer-controller-fipsAll versions (No fix recorded)
aws-s3-controllerAll versions (No fix recorded)
backup-restore-operator-7.0< 7.0.6-r1
cass-operatorAll versions (No fix recorded)
cass-operator-fipsAll versions (No fix recorded)
cass-operator-fips-no-pvc-deleteAll versions (No fix recorded)
cert-manager-fips-1.17All versions (No fix recorded)
cilium-1.16-envoyAll versions (No fix recorded)
cilium-envoy-1.16All versions (No fix recorded)
cilium-envoy-1.17< 1.17.13-r0
cilium-envoy-fips-1.15All versions (No fix recorded)
cilium-envoy-fips-1.16All versions (No fix recorded)
cilium-envoy-fips-1.17< 1.17.13-r0
cilium-fips-1.15All versions (No fix recorded)
cilium-fips-1.15-clustermesh-apiserverAll versions (No fix recorded)
cilium-fips-1.15-host-utilsAll versions (No fix recorded)
cilium-fips-1.15-hubble-relayAll versions (No fix recorded)
cilium-fips-1.15-operator-awsAll versions (No fix recorded)
cilium-fips-1.15-operator-azureAll versions (No fix recorded)
cilium-fips-1.15-operator-genericAll versions (No fix recorded)
cis-operator-1.2All versions (No fix recorded)
cis-operator-1.3All versions (No fix recorded)
cloud-provider-aws-1.28-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.28-ecr-credential-providerAll versions (No fix recorded)
cloud-provider-aws-1.31-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.31-ecr-credential-providerAll versions (No fix recorded)
cloud-provider-aws-fips-1.28-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.28-ecr-credential-providerAll versions (No fix recorded)
cluster-api-ipam-provider-in-clusterAll versions (No fix recorded)
cluster-proportional-autoscalerAll versions (No fix recorded)
cluster-proportional-autoscaler-fipsAll versions (No fix recorded)
cni-pluginsAll versions (No fix recorded)
cni-plugins-aws-k8s-compatAll versions (No fix recorded)
cni-plugins-dhcpAll versions (No fix recorded)
cni-plugins-fipsAll versions (No fix recorded)
cni-plugins-fips-dhcpAll versions (No fix recorded)
cni-plugins-fips-ipamAll versions (No fix recorded)
cni-plugins-ipamAll versions (No fix recorded)
consul-k8s-1.1All versions (No fix recorded)
consul-k8s-1.3All versions (No fix recorded)
consul-k8s-1.4All versions (No fix recorded)
consul-k8s-1.5All versions (No fix recorded)
consul-k8s-1.6All versions (No fix recorded)
consul-k8s-1.7All versions (No fix recorded)
consul-k8s-1.9All versions (No fix recorded)
consul-k8s-fips-1.1All versions (No fix recorded)
consul-k8s-fips-1.3All versions (No fix recorded)
consul-k8s-fips-1.3-cliAll versions (No fix recorded)
consul-k8s-fips-1.4All versions (No fix recorded)
consul-k8s-fips-1.5All versions (No fix recorded)
consul-k8s-fips-1.6All versions (No fix recorded)
container-object-storage-interface-controllerAll versions (No fix recorded)
container-object-storage-interface-controller-fipsAll versions (No fix recorded)
container-object-storage-interface-sidecarAll versions (No fix recorded)
container-object-storage-interface-sidecar-fipsAll versions (No fix recorded)
contour-1.31All versions (No fix recorded)
contour-1.32All versions (No fix recorded)
contour-fips-1.30All versions (No fix recorded)
contour-fips-1.31All versions (No fix recorded)
contour-fips-1.32All versions (No fix recorded)
crossplane-function-auto-readyAll versions (No fix recorded)
crossplane-function-auto-ready-fipsAll versions (No fix recorded)
crossplane-function-environment-configsAll versions (No fix recorded)
crossplane-function-environment-configs-fipsAll versions (No fix recorded)
custom-pod-autoscalerAll versions (No fix recorded)
custom-pod-autoscaler-fipsAll versions (No fix recorded)
custom-pod-autoscaler-operatorAll versions (No fix recorded)
custom-pod-autoscaler-operator-fipsAll versions (No fix recorded)
cyberark-secrets-provider-for-k8sAll versions (No fix recorded)
cyberark-secrets-provider-for-k8s-fipsAll versions (No fix recorded)
deckAll versions (No fix recorded)
deck-fipsAll versions (No fix recorded)
diveAll versions (No fix recorded)
docker-machine-driver-harvesterAll versions (No fix recorded)
doppler-kubernetes-operatorAll versions (No fix recorded)
dragonfly-operatorAll versions (No fix recorded)
dragonfly-operator-fipsAll versions (No fix recorded)
eks-distro-kube-apiserver-1.34All versions (No fix recorded)
eks-distro-kube-apiserver-fips-1.29All versions (No fix recorded)
eks-distro-kube-apiserver-fips-1.34All versions (No fix recorded)
eks-distro-kube-controller-manager-1.34All versions (No fix recorded)
eks-distro-kube-controller-manager-fips-1.29All versions (No fix recorded)
eks-distro-kube-controller-manager-fips-1.34All versions (No fix recorded)
eks-distro-kube-proxy-1.34All versions (No fix recorded)
eks-distro-kube-proxy-fips-1.29All versions (No fix recorded)
eks-distro-kube-proxy-fips-1.34All versions (No fix recorded)
eks-distro-kube-scheduler-1.34All versions (No fix recorded)
eks-distro-kube-scheduler-fips-1.29All versions (No fix recorded)
eks-distro-kube-scheduler-fips-1.34All versions (No fix recorded)
emissaryAll versions (No fix recorded)
emissary-apiextAll versions (No fix recorded)
envoy-ratelimitAll versions (No fix recorded)
envoy-ratelimit-fipsAll versions (No fix recorded)
etcd-3.4< 3.4.45-r0
etcd-fips-3.4< 3.4.45-r0
falco-exporterAll versions (No fix recorded)
falco-exporter-fipsAll versions (No fix recorded)
falcoctl-fips-0.4All versions (No fix recorded)
filebeat-fips-8.17All versions (No fix recorded)
filebeat-fips-8.18All versions (No fix recorded)
filebeat-fips-9.0All versions (No fix recorded)
fleet-server-8.17All versions (No fix recorded)
fleet-server-8.18All versions (No fix recorded)
fleet-server-9.0All versions (No fix recorded)
fleet-server-fips-8.17All versions (No fix recorded)
fleet-server-fips-8.18All versions (No fix recorded)
fleet-server-fips-9.0All versions (No fix recorded)
fluxcd-kustomize-mutating-webhookAll versions (No fix recorded)
fluxcd-kustomize-mutating-webhook-fipsAll versions (No fix recorded)
fuse-overlayfs-snapshotter< 2.1.7-r2
gendesk< 1.0.10-r6
github-mcp-serverAll versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-18.8< 18.8.4-r1
gitlab-workhorse-ce-18.7All versions (No fix recorded)
gitlab-workhorse-ce-18.8All versions (No fix recorded)
gitness< 3.3.0-r9
gke-gcloud-auth-pluginAll versions (No fix recorded)
glowAll versions (No fix recorded)
go-licensesAll versions (No fix recorded)
gostatsdAll versions (No fix recorded)
gpu-feature-discovery< 0.18.2-r4
gpu-feature-discovery-fipsAll versions (No fix recorded)
gpu-operator-24.9All versions (No fix recorded)
gpu-operator-fips-24.9All versions (No fix recorded)
grafana-11.4All versions (No fix recorded)
grafana-fips-11.4All versions (No fix recorded)
grafana-pyroscope-1.12All versions (No fix recorded)
grafana-pyroscope-1.13All versions (No fix recorded)
grpcurlAll versions (No fix recorded)
grpcurl-fipsAll versions (No fix recorded)
harbor-scanner-trivyAll versions (No fix recorded)
harbor-scanner-trivy-fipsAll versions (No fix recorded)
heartbeat-fips-8.17All versions (No fix recorded)
heartbeat-fips-8.18All versions (No fix recorded)
heartbeat-fips-9.0All versions (No fix recorded)
ip-masq-agentAll versions (No fix recorded)
jaeger-operatorAll versions (No fix recorded)
jaeger-operator-fipsAll versions (No fix recorded)
jitsucom-bulker-bulkerAll versions (No fix recorded)
jitsucom-bulker-ingestAll versions (No fix recorded)
jitsucom-bulker-ingmgrAll versions (No fix recorded)
jitsucom-bulker-sidecarAll versions (No fix recorded)
jitsucom-bulker-syncctlAll versions (No fix recorded)
juicefs-csi-driverAll versions (No fix recorded)
k3s-1.31< 1.31.6.1-r10
k3s-1.32< 1.32.13.1-r2
k3s-1.33< 1.33.10.1-r0
k3s-1.34< 1.34.6.1-r6
k3s-multicall-1.31< 1.31.6.1-r10
k3s-multicall-1.32< 1.32.13.1-r2
k3s-multicall-1.33< 1.33.10.1-r0
k3s-multicall-1.34< 1.34.6.1-r6
k3s-static< 1.35.3.1-r9
k3s-static-1.31< 1.31.6.1-r10
k3s-static-1.32< 1.32.13.1-r2 | < 1.32.13.1-r4
k3s-static-1.33< 1.33.10.1-r0
k3s-static-1.34< 1.34.6.1-r6
k8s-metacollectorAll versions (No fix recorded)
k8s-metacollector-fipsAll versions (No fix recorded)
k8sgpt-operatorAll versions (No fix recorded)
k8ssandra-operatorAll versions (No fix recorded)
k8ssandra-operator-fipsAll versions (No fix recorded)
karpenter-0.33All versions (No fix recorded)
karpenter-0.34All versions (No fix recorded)
karpenter-0.35All versions (No fix recorded)
karpenter-0.36All versions (No fix recorded)
karpenter-0.37All versions (No fix recorded)
karpenter-1.0All versions (No fix recorded)
karpenter-1.1All versions (No fix recorded)
karpenter-1.2All versions (No fix recorded)
karpenter-1.3All versions (No fix recorded)
karpenter-1.4All versions (No fix recorded)
karpenter-1.5All versions (No fix recorded)
karpenter-1.6All versions (No fix recorded)
karpenter-1.7All versions (No fix recorded)
karpenter-1.8All versions (No fix recorded)
karpenter-fips-0.33All versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 695

References

15 links

go.dev/cl/709876REPORTFIXWEBPatch
github.com/golang/vulndb/issues/4440REPORTWEBIssue Tracking
groups.google.com/g/golang-announce/c/jnQcOYpiR2cREPORTAdvisoryWEBMailing ListThird Party Advisory
pkg.go.dev/vuln/GO-2026-4440REPORTAdvisoryWEBVendor Advisory
ubuntu.com/security/CVE-2025-47911REPORT
www.cve.org/CVERecord?id=CVE-2025-47911REPORT
github.com/golang/go/issues/75682REPORT
ubuntu.com/security/notices/USN-8089-1Advisory
ubuntu.com/security/notices/USN-8089-2Advisory
ubuntu.com/security/notices/USN-8089-3Advisory

Show all 15 references

ubuntu.com/security/notices/USN-8900-1Advisory
security-tracker.debian.org/tracker/CVE-2025-47911Advisory
nvd.nist.gov/vuln/detail/CVE-2025-47911AdvisoryOval
go.googlesource.com/netPACKAGE
www.suse.com/security/cve/CVE-2025-47911WEB