Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-25680 EUVD-2026-31447GHSA-5cv4-jp36-h3mwGO-2026-5028

Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

Published May 22, 2026 · Updated May 22, 2026 · Assigned by Go

Vendor: golang.org/x/net Product: golang.org/x/net/html Package: application-gateway-kubernetes-ingress Package: azl-otel-collector Package: caddy Package: cert-manager Package: cf-cli Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cloud-provider-kubevirt Package: cni-plugins Package: containerd2 Package: containerized-data-importer Package: coredns-1.13 Package: cri-o Package: cri-tools Package: crossplane-provider-aws-elasticache Package: crossplane-provider-azure-authorization Package: crossplane-provider-azure-storage Package: dasel Package: docker-buildx Package: docker-compose Package: dogstatsd-7.77 Package: external-secrets-operator-1.1 Package: falco-no-driver Package: flux-2.7 Package: flux-2.8 Package: fq Package: gh Package: gitaly-18.6 Package: gitaly-18.7 Package: gitaly-18.8 Package: gitaly-backup-18.6 Package: gitaly-backup-18.7 Package: gitaly-backup-18.8 Package: gitea Package: gitlab-agent-18.6 Package: gitlab-agent-18.7 Package: gitlab-agent-18.8 Package: gitlab-agent-18.9 Package: gitlab-docker-machine-18.6 Package: gitlab-docker-machine-18.7 Package: gitlab-docker-machine-18.8 Package: gitlab-kas-18.6 Package: gitlab-kas-18.7 Package: gitlab-kas-18.8 Package: gitlab-kas-18.9 Package: gitlab-pages-18.6 Package: gitlab-pages-18.7 Package: gitlab-pages-18.8 Package: gitlab-pages-18.9 Package: glab Package: golang-golang-x-net Package: golang-golang-x-net-dev Package: golang.org/x/net Package: gptscript Package: grafana-pyroscope-1.19 Package: grafana-pyroscope-2.0 Package: helm-3 Package: hubble Package: hydra Package: influxdb Package: k3s Package: k3s-multicall Package: k3s-static Package: k3s-static-1.34 Package: keda Package: kine Package: kots Package: kube-vip-cloud-provider Package: kubectl-1.32 Package: kubernetes Package: kubernetes-dashboard Package: kubevirt Package: kubevirt-openvmm Package: kuma-coredns-1.13 Package: kyverno-1.17 Package: kyverno-1.18 Package: kyverno-background-controller-1.17 Package: kyverno-background-controller-1.18 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cleanup-controller-1.18 Package: kyverno-cli-1.17 Package: kyverno-cli-1.18 Package: kyverno-init-container-1.17 Package: kyverno-init-container-1.18 Package: kyverno-readiness-checker-1.17 Package: kyverno-readiness-checker-1.18 Package: kyverno-reports-controller-1.17 Package: kyverno-reports-controller-1.18 Package: mattermost-11.1 Package: minio Package: multus Package: nerdctl Package: opentelemetry-collector Package: packer Package: podman Package: prometheus-3.10 Package: prometheus-3.11 Package: prometheus-3.8 Package: prometheus-3.9 Package: prometheus-adapter Package: prometheus-admission-webhook Package: prometheus-config-reloader Package: prometheus-operator Package: snyk-cli Package: sriov-network-device-plugin Package: step Package: step-issuer Package: telegraf Package: telegraf-1.38 Package: terraform-provider-acme Package: traefik-3.6 Package: traefik-3.7 Package: vale Package: vitess-23 Package: vitess-23-binaries Package: yq Package: zot Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Affected products

VendorProductAffectedFixed
golang.org/x/net golang.org/x/net/html < 0.55.0 0.55.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-golang-x-net 1:0.55.0-1 —
Debian 13 golang-golang-x-net No fix yet —
Debian 12 golang-golang-x-net No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS golang-golang-x-net-dev No fix yet —
Ubuntu Pro 18.04 LTS golang-golang-x-net-dev No fix yet —
Ubuntu Pro 16.04 LTS golang-golang-x-net-dev No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 alloy 1.17.1-150700.15.23.1 SUSE-SU-2026:2824-1
SLES 15 SP7 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES 15 SP7 containerized-data-importer 1.64.0-150700.9.14.1 SUSE-SU-2026:4209-1
SLES 15 SP7 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES 15 SP7 grafana 12.4.5-150200.3.91.1 SUSE-SU-2026:3718-1
SLES 15 SP7 kubevirt 1.7.4-150700.3.30.1 SUSE-SU-2026:3203-1
SLES 15 SP7 kubevirt-1.6 1.6.6-150700.15.17.1 SUSE-SU-2026:3630-1
SLES 15 SP6 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES 15 SP6 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES 15 SP5 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES 15 SP5 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES 15 SP5 terraform-provider-aws 3.11.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-azurerm 2.32.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-external 2.0.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-google 3.43.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-helm 2.9.0-150200.6.23.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-kubernetes 1.13.2-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-local 2.0.0-150200.6.17.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-null 3.0.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-random 3.0.0-150200.6.15.1 SUSE-SU-2026:3056-1
SLES 15 SP5 terraform-provider-tls 3.0.0-150200.5.15.1 SUSE-SU-2026:3056-1
SLES 15 SP4 buildah 1.35.5-150400.3.68.1 SUSE-SU-2026:2706-1
SLES 15 SP4 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES 15 SP4 terraform-provider-aws 3.11.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-azurerm 2.32.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-external 2.0.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-google 3.43.0-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-helm 2.9.0-150200.6.23.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-kubernetes 1.13.2-150200.6.12.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-local 2.0.0-150200.6.17.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-null 3.0.0-150200.6.18.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-random 3.0.0-150200.6.15.1 SUSE-SU-2026:3056-1
SLES 15 SP4 terraform-provider-tls 3.0.0-150200.5.15.1 SUSE-SU-2026:3056-1
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 alloy 1.17.0-160000.1.1 SUSE-SU-2026:22575-1
SLES for SAP 16.0 cosign 3.1.1-160000.1.1 SUSE-SU-2026:22613-1
SLES for SAP 16.0 mcphost 0.34.0-160000.2.1 SUSE-SU-2026:22193-1
SLES for SAP 15 SP6 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES for SAP 15 SP6 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES for SAP 15 SP5 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLES for SAP 15 SP5 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES for SAP 15 SP4 buildah 1.35.5-150400.3.68.1 SUSE-SU-2026:2706-1
SLES for SAP 15 SP4 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLES 16.0 alloy 1.17.0-160000.1.1 SUSE-SU-2026:22575-1
SLES 16.0 cosign 3.1.1-160000.1.1 SUSE-SU-2026:22613-1
SLES 16.0 mcphost 0.34.0-160000.2.1 SUSE-SU-2026:22193-1
SLE Micro 6.2 mcphost 0.34.0-160000.2.1 SUSE-SU-2026:22226-1
SLE Micro 6.1 elemental-operator 1.7.5-slfo.1.1_1.1 SUSE-SU-2026:22075-1
SLE Micro 6.1 elemental-toolkit 2.2.9-slfo.1.1_1.1 SUSE-SU-2026:22074-1
SLE Micro 6.0 elemental-operator 1.6.11-1.1 SUSE-SU-2026:22066-1
SLE Micro 6.0 elemental-toolkit 2.1.6-1.1 SUSE-SU-2026:22065-1
SLE HPC 15 SP5 buildah 1.35.5-150500.3.62.1 SUSE-SU-2026:2733-1
SLE HPC 15 SP5 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SLE HPC 15 SP4 buildah 1.35.5-150400.3.68.1 SUSE-SU-2026:2706-1
SLE HPC 15 SP4 cosign 3.1.1-150400.3.45.1 SUSE-SU-2026:2827-1
SUSE Multi Linux Manager Tools SLE-Micro-5 dracut-saltboot 1.2.1-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-Micro-5 golang-github-prometheus-node_exporter 1.10.2-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-Micro-5 uyuni-tools 5.2.12-150002.3.17.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 dracut-saltboot 1.2.1-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-QubitProducts-exporter_exporter 0.4.0-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-boynux-squid_exporter 1.13.0-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-lusitaniae-apache_exporter 1.0.10-150002.3.9.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-alertmanager 0.28.1-150002.4.11.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-node_exporter 1.10.2-150002.3.6.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-prometheus 3.5.3-150002.3.13.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 grafana 11.6.14+security04-150002.4.21.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 mgr-push 5.2.4-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 prometheus-blackbox_exporter 0.26.0-150002.3.11.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 prometheus-postgres_exporter 0.10.1-150002.3.3.2 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 python-defusedxml-sle15 0.7.1-150002.1.3.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 rhnlib 5.2.5-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 spacecmd 5.2.8-150002.3.12.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 spacewalk-client-tools 5.2.6-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 supportutils-plugin-salt 1.2.3-150002.3.3.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 supportutils-plugin-susemanager-client 5.2.3-150002.3.9.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-common-libs 5.2.5-150002.3.6.1 SUSE-SU-2026:2768-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-tools 5.2.12-150002.3.17.1 SUSE-SU-2026:2768-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed alloy 1.17.0-1.1 openSUSE-SU-2026:11053-1
openSUSE Tumbleweed amfora 1.11.0-3.1 openSUSE-SU-2026:11152-1
openSUSE Tumbleweed cosign 3.1.1-1.1 openSUSE-SU-2026:11198-1
openSUSE Tumbleweed git-bug 0.10.1-5.1 openSUSE-SU-2026:10949-1
openSUSE Tumbleweed grafana 11.6.14+security04-3.1 openSUSE-SU-2026:11013-1
openSUSE Tumbleweed hauler 1.4.3-5.1 openSUSE-SU-2026:10933-1
openSUSE Tumbleweed lux 0.24.1-1.1 openSUSE-SU-2026:11294-1
openSUSE Tumbleweed mcphost 0.34.0-8.1 openSUSE-SU-2026:10923-1
openSUSE Tumbleweed percona-toolkit 3.7.1.4-1.1 openSUSE-SU-2026:12166-1
openSUSE Tumbleweed rclone 1.74.2-1.1 openSUSE-SU-2026:10856-1
openSUSE Tumbleweed trivy 0.71.0-1.1 openSUSE-SU-2026:10941-1
openSUSE Tumbleweed velociraptor 0.7.0.4.git185.a5708584-2.1 openSUSE-SU-2026:11126-1
openSUSE Tumbleweed yq 4.53.2-2.1 openSUSE-SU-2026:10930-1
openSUSE Tumbleweed zabbix 7.0.28-1.1 openSUSE-SU-2026:11304-1
openSUSE Leap 16.0 alloy 1.17.0-160000.1.1 openSUSE-SU-2026:21251-1
openSUSE Leap 16.0 containerized-data-importer1.65 1.65.0-160000.3.1 openSUSE-SU-2026:21824-1
openSUSE Leap 16.0 cosign 3.1.1-160000.1.1 openSUSE-SU-2026:21281-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 16.0 grafana 11.6.14+security04-bp160.2.1 openSUSE-SU-2026:20984-1
openSUSE Leap 16.0 hauler 2.0.1-bp160.1.1 openSUSE-SU-2026:21262-1
openSUSE Leap 16.0 kubevirt1.8 1.8.4-160000.1.1 openSUSE-SU-2026:21590-1
openSUSE Leap 16.0 lux 0.24.1-bp160.1.1 openSUSE-SU-2026:21367-1
openSUSE Leap 16.0 mcphost 0.34.0-160000.2.1 openSUSE-SU-2026:21120-1
openSUSE Leap 16.0 neonmodem 1.0.7+git0.346d1d3-bp160.1.1 openSUSE-SU-2026:20963-1
openSUSE Leap 16.0 rclone 1.74.4-bp160.1.1 openSUSE-SU-2026:21436-1
openSUSE Leap 16.0 trivy 0.71.0-160000.1.1 openSUSE-SU-2026:20956-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300067.1-1.amzn2023 ALAS2023-2026-1896
Amazon Linux 2023 cni-plugins 1.7.1-1.amzn2023.0.7 ALAS2023-2026-1888
Amazon Linux 2023 containerd +1 2.2.4-1.amzn2023.0.2 ALAS2023-2026-1847
Amazon Linux 2023 credentials-fetcher 2.0.3-1.amzn2023.0.1 ALAS2023-2026-1885
Amazon Linux 2023 docker 25.0.16-1.amzn2023.0.2 ALAS2023-2026-1835
Amazon Linux 2023 ecs-init 1.105.0-1.amzn2023 ALAS2023-2026-1902
Amazon Linux 2023 git-lfs 3.7.1-81.amzn2023 ALAS2023-2026-1889
Amazon Linux 2023 nerdctl 2.2.2-1.amzn2023.0.3 ALAS2023-2026-1788
Amazon Linux 2023 runfinch-finch 1.17.1-1.amzn2023.0.3 ALAS2023-2026-1886
Amazon Linux 2023 soci-snapshotter 0.14.1-1.amzn2023.0.1 ALAS2023-2026-1884
Amazon Linux 2023 yq 4.53.3-14.amzn2023 ALAS2023-2026-1887
Amazon Linux 2 amazon-cloudwatch-agent 1.300067.1-1.amzn2 ALAS2-2026-3389
Amazon Linux 2 cni-plugins 1.7.1-1.amzn2.0.7 ALAS2-2026-3386
Amazon Linux 2 cri-tools 1.32.0-1.amzn2.0.7 ALAS2-2026-3385
Amazon Linux 2 nerdctl 2.2.2-1.amzn2.0.3 ALAS2-2026-3334
Amazon Linux 2 rclone 1.55.1-1.amzn2.0.8 ALAS2-2026-3384

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 application-gateway-kubernetes-ingress 1.7.7-5 —
Azure Linux 3 cert-manager 1.12.15-9 —
Azure Linux 3 cf-cli 8.7.11-7 —
Azure Linux 3 cloud-provider-kubevirt 0.5.1-5 —
Azure Linux 3 cni-plugins 1.4.0-6 —
Azure Linux 3 containerd2 2.2.4-4 —
Azure Linux 3 containerized-data-importer 1.62.0-6 —
Azure Linux 3 cri-tools 1.32.0-6 —
Azure Linux 3 dasel 2.8.1-4 —
Azure Linux 3 docker-buildx 0.14.0-15 —
Azure Linux 3 docker-compose 2.27.0-12 —
Azure Linux 3 gh 2.62.0-17 —
Azure Linux 3 influxdb 2.7.5-17 —
Azure Linux 3 keda 2.14.1-14 —
Azure Linux 3 kube-vip-cloud-provider 0.0.10-6 —
Azure Linux 3 kubernetes 1.30.10-25 —
Azure Linux 3 kubevirt 1.7.1-7 —
Azure Linux 3 multus 4.0.2-9 —
Azure Linux 3 packer 1.9.5-15 —
Azure Linux 3 prometheus-adapter 0.12.0-6 —
Azure Linux 3 sriov-network-device-plugin 3.7.0-6 —
Azure Linux 3 telegraf 1.31.0-23 —
Azure Linux 3 yq +4 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling caddy 2.11.3-r3 —
Wolfi rolling cilium-1.19 +4 1.19.4-r4 —
Wolfi rolling crossplane-provider-aws-elasticache 2.5.0-r9 —
Wolfi rolling crossplane-provider-azure-authorization 2.5.0-r13 —
Wolfi rolling crossplane-provider-azure-storage 2.5.0-r11 —
Wolfi rolling dogstatsd-7.77 7.77.3-r11 —
Wolfi rolling falco-no-driver 0.44.1-r6 —
Wolfi rolling flux-2.7 2.7.5-r20 —
Wolfi rolling flux-2.8 2.8.8-r3 —
Wolfi rolling fq 0.17.0-r8 —
Wolfi rolling gitaly-18.6 +24 No fix yet —
Wolfi rolling gitea 1.26.2-r3 —
Wolfi rolling glab 1.101.0-r1 —
Wolfi rolling gptscript 0.9.9-r280 —
Wolfi rolling grafana-pyroscope-2.0 2.0.3-r0 —
Wolfi rolling helm-3 3.21.0-r4 —
Wolfi rolling hubble +1 1.19.3-r6 —
Wolfi rolling hydra 26.2.0-r8 —
Wolfi rolling k3s +2 1.36.1.1-r0 —
Wolfi rolling k3s-static-1.34 1.34.6.1-r13 —
Wolfi rolling kine 0.16.1-r1 —
Wolfi rolling kots 1.130.4-r5 —
Wolfi rolling kubectl-1.32 1.32.13-r1 —
Wolfi rolling kubernetes-dashboard 7.14.0-r9 —
Wolfi rolling kyverno-1.17 1.17.2-r35 —
Wolfi rolling kyverno-1.18 +6 1.18.1-r4 —
Wolfi rolling kyverno-cli-1.17 +5 1.17.2-r9 —
Wolfi rolling mattermost-11.1 11.10.0-r0 —
Wolfi rolling minio 0.20260520.234452-r3 —
Wolfi rolling nerdctl 2.3.1-r4 —
Wolfi rolling opentelemetry-collector 0.152.1-r4 —
Wolfi rolling prometheus-3.10 3.10.0-r22 —
Wolfi rolling prometheus-3.11 3.11.3-r16 —
Wolfi rolling prometheus-3.9 3.9.1-r7 —
Wolfi rolling prometheus-operator +2 0.91.0-r4 —
Wolfi rolling snyk-cli 1.1304.3-r5 —
Wolfi rolling step 0.30.2-r10 —
Wolfi rolling step-issuer 0.10.2-r15 —
Wolfi rolling telegraf-1.38 1.38.4-r5 —
Wolfi rolling terraform-provider-acme 2.48.1-r4 —
Wolfi rolling traefik-3.6 3.6.17-r3 —
Wolfi rolling traefik-3.7 3.7.1-r3 —
Wolfi rolling vale 3.14.2-r3 —
Wolfi rolling vitess-23 +1 23.0.4-r5 —
Wolfi rolling zot 2.1.17-r4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go golang.org/x/net < 0.55.0 0.55.0 GHSA-5cv4-jp36-h3mw

Advisories 50

References