CVE-2026-25680

Aliases:GO-2026-5028GHSA-5cv4-jp36-h3mw
Advisory lineage Upstream: 0 Downstream: 37
Analyzed
Published: 22 May 2026, 15:01
Last modified:22 May 2026, 17:00

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.25% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

22 May 2026, 15:01
Published
Vulnerability first disclosed
22 May 2026, 17:00
Last Modified
Vulnerability information updated

Description

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.25%• Percentile: 16%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • golang.org/x•net

    < 0.55.0

  • golang•net

    < 0.55.0

  • golang.org/x/net•golang.org/x/net/html

    < 0.55.0

References (8)