Skip to content
OpenAdvisories
Medium · 5.3 CVE-2025-47911 EUVD-2025-206856GHSA-w4gw-w5jq-g9jhGO-2026-4440

Quadratic parsing complexity in golang.org/x/net/html

Published Feb 5, 2026 · Updated Feb 12, 2026 · Assigned by Go

Description

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Affected products

VendorProductAffectedFixed
golang.org/x/net golang.org/x/net/html < 0.45.0 0.45.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 golang-golang-x-net 1:0.47.0-1 —
Debian 13 golang-golang-x-net No fix yet —
Debian 12 golang-golang-x-net No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-golang-x-net No fix yet —
Ubuntu 26.04 LTS golang-golang-x-net No fix yet —
Ubuntu 25.10 golang-golang-x-net No fix yet —
Ubuntu 22.04 LTS golang-golang-x-net 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1 USN-8900-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS golang-golang-x-net 1:0.21.0+dfsg-1ubuntu0.1~esm2 USN-8089-1
Ubuntu Pro 22.04 LTS golang-golang-x-net 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm2 USN-8089-1
Ubuntu Pro 20.04 LTS golang-golang-x-net-dev 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2 —
Ubuntu Pro 18.04 LTS golang-golang-x-net-dev 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2 —
Ubuntu Pro 18.04 LTS lxd 3.0.3-0ubuntu1~18.04.2+esm2 —
Ubuntu Pro 16.04 LTS golang-golang-x-net-dev 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2 —
Ubuntu Pro 16.04 LTS juju-core 2.3.7-0ubuntu0.16.04.1+esm2 —
Ubuntu Pro 16.04 LTS lxd 2.0.11-0ubuntu1~16.04.4+esm2 —
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 golang1.25 +6 1.25.9-1.hum1 RHSA-2026:7385
Red Hat Hardened Images 1 golang1.26 +6 1.26.2-1.hum1 RHSA-2026:7291
ReleasePackageFixed inAdvisory
SLES 15 SP7 alloy 1.12.1-150700.15.12.1 SUSE-SU-2026:0028-1
SLES 15 SP7 apptainer 1.4.5-150600.4.15.1 SUSE-SU-2026:0580-1
SLES 15 SP7 containerized-data-importer 1.64.0-150700.9.11.1 SUSE-SU-2026:2493-1
SLES 15 SP7 grafana 11.5.10-150200.3.80.1 SUSE-SU-2025:4482-1
SLES 15 SP7 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
SLES 15 SP7 kubevirt 1.7.4-150700.3.24.2 SUSE-SU-2026:2400-1
SLES 15 SP7 kubevirt-1.6 1.6.6-150700.15.7.1 SUSE-SU-2026:3630-1, SUSE-SU-2026:2401-1
SLES 15 SP6 grafana 11.5.10-150200.3.80.1 SUSE-SU-2025:4482-1
SLES 15 SP6 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
SLES 15 SP5 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
SLES 15 SP5 terraform-provider-aws 3.11.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-azurerm 2.32.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-external 2.0.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-google 3.43.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-helm 2.9.0-150200.6.23.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-kubernetes 1.13.2-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-local 2.0.0-150200.6.17.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-null 3.0.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-random 3.0.0-150200.6.15.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-tls 3.0.0-150200.5.15.1 SUSE-SU-2026:3056-1
SLES 15 SP4 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
SLES 15 SP4 terraform-provider-aws 3.11.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-azurerm 2.32.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-external 2.0.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-google 3.43.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-helm 2.9.0-150200.6.23.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-kubernetes 1.13.2-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-local 2.0.0-150200.6.17.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-null 3.0.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-random 3.0.0-150200.6.15.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-tls 3.0.0-150200.5.15.1 SUSE-SU-2026:3056-1
SLES 15 SP3 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
Show 18 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 alloy 1.12.1-160000.1.1 SUSE-SU-2026:20089-1
SLES for SAP 16.0 google-osconfig-agent 20260615.01-160000.1.2 SUSE-SU-2026:22558-1
SLES for SAP 15 SP5 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
SLES for SAP 15 SP4 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
SLES for SAP 15 SP3 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
SLES 16.0 alloy 1.12.1-160000.1.1 SUSE-SU-2026:20089-1
SLES 16.0 google-osconfig-agent 20260615.01-160000.1.2 SUSE-SU-2026:22558-1
SLE Micro 6.2 elemental-register 1.8.1-160000.1.1 SUSE-SU-2026:20176-1
SLE Micro 6.2 elemental-toolkit 2.3.2-160000.1.1 SUSE-SU-2026:20176-1
SLE Micro 6.2 helm 3.19.1-160000.1.1 SUSE-SU-2026:20685-1
SLE Micro 6.1 elemental-operator 1.7.4-slfo.1.1_1.1 SUSE-SU-2026:20357-1
SLE Micro 6.1 elemental-toolkit 2.2.7-slfo.1.1_1.1 SUSE-SU-2026:20357-1
SLE Micro 6.1 google-osconfig-agent 20260615.01-slfo.1.1_1.1 SUSE-SU-2026:22249-1
SLE Micro 6.1 helm 3.19.1-slfo.1.1_1.1 SUSE-SU-2025:21221-1
SLE Micro 6.0 elemental-operator 1.6.10-1.1 SUSE-SU-2026:20244-1
SLE Micro 6.0 elemental-toolkit 2.1.5-1.1 SUSE-SU-2026:20244-1
SLE Micro 6.0 google-osconfig-agent 20260615.01-1.1 SUSE-SU-2026:22242-1
SLE Micro 6.0 helm 3.19.1-1.1 SUSE-SU-2025:21043-1
SLE Micro 5.5 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
SLE HPC 15 SP5 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
SLE HPC 15 SP4 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
SLE HPC 15 SP3 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
SUSE Multi Linux Manager Tools SLE-Micro-5 uyuni-tools 5.1.23-150002.3.6.1 SUSE-SU-2025:4446-1
SUSE Multi Linux Manager Tools SLE-15 grafana 11.5.10-150002.4.6.1 SUSE-SU-2025:4446-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-tools 5.1.23-150002.3.6.1 SUSE-SU-2025:4446-1
SUSE Multi Linux Manager Tools SLE-12 Multi-Linux-ManagerTools-SLE-release 12-120002.1.11.1 SUSE-SU-2025:4444-1
SUSE Multi Linux Manager Tools SLE-12 grafana 11.5.10-120002.4.6.1 SUSE-SU-2025:4444-1
SUSE Multi Linux Manager Tools SLE-12 uyuni-tools 5.1.23-120002.3.6.1 SUSE-SU-2025:4444-1
SUSE Manager Server LTS 4.3 release-notes-susemanager 4.3.16.2-150400.3.148.1 SUSE-SU-2025:4479-1
SUSE Manager Proxy LTS 4.3 release-notes-susemanager-proxy 4.3.16.2-150400.3.104.2 SUSE-SU-2025:4479-1
SUSE Enterprise Storage 7.1 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed alloy 1.12.0-2.1 openSUSE-SU-2025:15830-1
openSUSE Tumbleweed apptainer 1.4.5-2.1 openSUSE-SU-2026:10173-1
openSUSE Tumbleweed containerized-data-importer1.66 1.66.0-1.1 openSUSE-SU-2026:11514-1
openSUSE Tumbleweed distrobuilder 3.2-4.1 openSUSE-SU-2025:15616-1
openSUSE Tumbleweed forgejo 12.0.4-2.1 openSUSE-SU-2025:15617-1
openSUSE Tumbleweed forgejo-longterm 11.0.6-2.1 openSUSE-SU-2025:15618-1
openSUSE Tumbleweed git-bug 0.10.1-2.1 openSUSE-SU-2025:15654-1
openSUSE Tumbleweed gitea-tea 0.11.0-2.1 openSUSE-SU-2025:15619-1
openSUSE Tumbleweed glow 2.1.1-2.1 openSUSE-SU-2025:15607-1
openSUSE Tumbleweed go-sendxmpp 0.15.1-1.1 openSUSE-SU-2025:15729-1
openSUSE Tumbleweed gomuks 0.3.1-2.1 openSUSE-SU-2025:15689-1
openSUSE Tumbleweed google-osconfig-agent 20251028.00-1.1 openSUSE-SU-2025:15709-1
openSUSE Tumbleweed grafana 11.6.7-1.1 openSUSE-SU-2025:15669-1
openSUSE Tumbleweed hauler 1.3.1-1.1 openSUSE-SU-2025:15722-1
openSUSE Tumbleweed headscale 0.26.1-2.1 openSUSE-SU-2025:15620-1
openSUSE Tumbleweed helm 3.19.1-1.1 openSUSE-SU-2025:15730-1
openSUSE Tumbleweed helm3 3.19.2-1.1 openSUSE-SU-2025:15779-1
openSUSE Tumbleweed kepler 0.11.3-1.1 openSUSE-SU-2025:15854-1
openSUSE Tumbleweed kubeseal 0.41.1-1.1 openSUSE-SU-2026:12299-1
openSUSE Tumbleweed kubevirt1.9 1.9.0-1.1 openSUSE-SU-2026:11520-1
openSUSE Tumbleweed kumactl 3.0.0-1.1 openSUSE-SU-2026:12300-1
openSUSE Tumbleweed kured 1.23.0-1.1 openSUSE-SU-2026:12271-1
openSUSE Tumbleweed lux 0.24.1-1.1 openSUSE-SU-2026:11294-1
openSUSE Tumbleweed ollama 0.12.6-1.1 openSUSE-SU-2025:15647-1
openSUSE Tumbleweed pocketbase 0.40.5-1.1 openSUSE-SU-2026:12167-1
openSUSE Tumbleweed sbctl 0.18-2.1 openSUSE-SU-2025:15743-1
openSUSE Tumbleweed timoni 0.36.0-1.1 openSUSE-SU-2026:12309-1
openSUSE Tumbleweed trivy 0.68.2-1.1 openSUSE-SU-2025:15852-1
openSUSE Tumbleweed v2ray-core 5.40.0-1.1 openSUSE-SU-2025:15624-1
openSUSE Tumbleweed velociraptor 0.7.0.4.git185.a5708584-2.1 openSUSE-SU-2026:11126-1
openSUSE Tumbleweed yq 4.53.2-1.1 openSUSE-SU-2026:10862-1
openSUSE Leap 16.0 alloy 1.12.1-160000.1.1 openSUSE-SU-2026:20044-1
openSUSE Leap 16.0 containerized-data-importer1.65 1.65.0-160000.3.1 openSUSE-SU-2026:21824-1
openSUSE Leap 16.0 elemental-register 1.8.1-160000.1.1 openSUSE-SU-2026:20132-1
openSUSE Leap 16.0 elemental-toolkit 2.3.2-160000.1.1 openSUSE-SU-2026:20132-1
openSUSE Leap 16.0 git-bug 0.10.1-bp160.1.1 openSUSE-SU-2025:20143-1
openSUSE Leap 16.0 gitea-tea 0.11.1-bp160.1.1 openSUSE-SU-2026:21603-1, openSUSE-SU-2026:20318-1, openSUSE-SU-2025:20118-1
openSUSE Leap 16.0 glab 1.114.0-bp160.1.1 openSUSE-SU-2026:21662-1
openSUSE Leap 16.0 go-sendxmpp 0.15.1-bp160.1.1 openSUSE-SU-2026:20058-1
openSUSE Leap 16.0 google-osconfig-agent 20260615.01-160000.1.2 openSUSE-SU-2026:21210-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 16.0 hauler 1.3.1-bp160.1.1 openSUSE-SU-2025:20160-1
openSUSE Leap 16.0 helm 3.19.1-160000.1.1 openSUSE-SU-2026:20327-1
openSUSE Leap 16.0 kepler 0.11.3-160000.1.1 openSUSE-SU-2026:20206-1
openSUSE Leap 16.0 lux 0.24.1-bp160.1.1 openSUSE-SU-2026:21367-1
openSUSE Leap 16.0 sbctl 0.18-bp160.1.1 openSUSE-SU-2026:20105-1
openSUSE Leap 16.0 shadowsocks-v2ray-plugin 5.25.0-bp160.1.1 openSUSE-SU-2025:20128-1
openSUSE Leap 16.0 v2ray-core 5.40.0-bp160.1.1 openSUSE-SU-2025:20128-1
openSUSE Leap 15.6 apptainer 1.4.5-150600.4.15.1 SUSE-SU-2026:0580-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20260205T172317-150000.1.146.1 SUSE-SU-2026:0403-1
openSUSE Leap 15.6 grafana 11.5.10-150200.3.80.1 SUSE-SU-2025:4482-1
openSUSE Leap 15.6 helm 3.19.1-150000.1.57.1 SUSE-SU-2025:4190-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 ecs-init 1.101.3-1.amzn2023 ALAS2023-2026-1443
Amazon Linux 2023 yq 4.47.1-12.amzn2023 ALAS2023-2026-1582

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 application-gateway-kubernetes-ingress 1.7.7-3 —
Azure Linux 3 cert-manager 1.12.15-6 —
Azure Linux 3 cf-cli 8.7.11-5 —
Azure Linux 3 cloud-provider-kubevirt 0.5.1-3 —
Azure Linux 3 cni 1.1.2-5 —
Azure Linux 3 cni-plugins 1.4.0-5 —
Azure Linux 3 containerd2 2.0.0-18 —
Azure Linux 3 containerized-data-importer 1.62.0-2 —
Azure Linux 3 cri-tools 1.32.0-4 —
Azure Linux 3 dasel 2.8.1-3 —
Azure Linux 3 docker-buildx 0.14.0-10 —
Azure Linux 3 docker-compose 2.27.0-8 —
Azure Linux 3 gh 2.62.0-13 —
Azure Linux 3 influxdb 2.7.5-13 —
Azure Linux 3 keda 2.14.1-11 —
Azure Linux 3 kube-vip-cloud-provider 0.0.10-5 —
Azure Linux 3 kubernetes 1.30.10-21 —
Azure Linux 3 kubevirt 1.7.0-3 —
Azure Linux 3 multus 4.0.2-7 —
Azure Linux 3 packer 1.9.5-13 —
Azure Linux 3 prometheus-adapter 0.12.0-5 —
Azure Linux 3 sriov-network-device-plugin 3.7.0-5 —
Azure Linux 3 telegraf 1.31.0-15 —
Azure Linux 3 yq +3 No fix yet —
Azure Linux 2 (CBL-Mariner) application-gateway-kubernetes-ingress 1.4.0-27 —
Azure Linux 2 (CBL-Mariner) cert-manager 1.11.2-27 —
Azure Linux 2 (CBL-Mariner) cf-cli 8.4.0-27 —
Azure Linux 2 (CBL-Mariner) cni 1.0.1-21 —
Azure Linux 2 (CBL-Mariner) cni-plugins 1.3.0-11 —
Azure Linux 2 (CBL-Mariner) containerized-data-importer 1.55.0-28 —
Azure Linux 2 (CBL-Mariner) cri-o 1.22.3-20 —
Azure Linux 2 (CBL-Mariner) cri-tools 1.29.0-9 —
Azure Linux 2 (CBL-Mariner) gh 2.13.0-26 —
Azure Linux 2 (CBL-Mariner) helm 3.14.2-10 —
Azure Linux 2 (CBL-Mariner) influxdb 2.6.1-30 —
Azure Linux 2 (CBL-Mariner) keda 2.4.0-32 —
Azure Linux 2 (CBL-Mariner) kubernetes 1.28.4-25 —
Azure Linux 2 (CBL-Mariner) kubevirt 0.59.0-38 —
Azure Linux 2 (CBL-Mariner) multus 4.0.2-10 —
Azure Linux 2 (CBL-Mariner) packer 1.9.5-18 —
Azure Linux 2 (CBL-Mariner) podman +2 No fix yet —
Azure Linux 2 (CBL-Mariner) prometheus-adapter 0.10.0-19 —
Azure Linux 2 (CBL-Mariner) sriov-network-device-plugin 3.6.2-11 —
Azure Linux 2 (CBL-Mariner) telegraf 1.29.4-21 —
Azure Linux 2 (CBL-Mariner) terraform 1.3.2-29 —
Azure Linux 2 (CBL-Mariner) vitess 17.0.7-14 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aws-load-balancer-controller 3.1.0-r1 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r2 —
Wolfi rolling gitness 3.3.0-r9 —
Wolfi rolling k3s-1.32 +2 1.32.13.1-r2 —
Wolfi rolling k3s-1.34 +2 1.34.6.1-r6 —
Wolfi rolling k3s-static 1.35.3.1-r9 —
Wolfi rolling kubectl-1.31 No fix yet —
Wolfi rolling mps-control-daemon +2 0.18.2-r4 —
Wolfi rolling runc 1.4.0-r3 —
Wolfi rolling wuzz 0.5.0-r18 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go golang.org/x/net < 0.45.0 0.45.0 GO-2026-4440
Go golang.org/x/net/html < 0.45.0 0.45.0 GHSA-w4gw-w5jq-g9jh

Advisories 50

References