CVE-2025-58190

Aliases:GO-2026-4441
Advisory lineage Upstream: 0 Downstream: 52
Analyzed
Published: 05 Feb 2026, 17:48
Last modified:12 Feb 2026, 15:22

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
5.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.01% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

05 Feb 2026, 17:48
Published
Vulnerability first disclosed
12 Feb 2026, 15:22
Last Modified
Vulnerability information updated

Description

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.01%• Percentile: 1%

Techniques & Countermeasures

  • CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

    The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Systems

  • go•html

    < 0.45.0

  • golang.org/x•net

    < 0.45.0

  • golang.org/x/net•golang.org/x/net/html

    < 0.45.0

References (4)