Description
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| golang.org/x/net | golang.org/x/net/html | < 0.62.0 | 0.62.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-golang-x-net | 1:0.62.0-1 | — |
| Debian 13 | golang-golang-x-net | No fix yet | — |
| Debian 12 | golang-golang-x-net | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | adsys +6 | No fix yet | — |
| Ubuntu 26.04 LTS | adsys +7 | No fix yet | — |
| Ubuntu 24.04 LTS | adsys +8 | No fix yet | — |
| Ubuntu 22.04 LTS | adsys +13 | No fix yet | — |
| Ubuntu 20.04 LTS | lxd +6 | No fix yet | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
| Ubuntu Pro 26.04 LTS | containerd | No fix yet | — |
| Ubuntu Pro 24.04 LTS | containerd +1 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | golang-1.13 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | adsys +5 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | lxd +7 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | lxd +7 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | amazon-cloudwatch-agent | 1.300074.0-1.1 | openSUSE-SU-2026:12425-1 |
| openSUSE Tumbleweed | google-osconfig-agent | 20261103.02-1.1 | openSUSE-SU-2026:12430-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-ssm-agent | 3.3.5828.0-1.amzn2023 | ALAS2023-2026-3428 |
| Amazon Linux 2023 | buildah | 2:1.43.1-1.amzn2023.0.4 | ALAS2023-2026-3451 |
| Amazon Linux 2023 | docker | 25.0.18-1.amzn2023.0.3 | ALAS2023-2026-3391 |
| Amazon Linux 2023 | skopeo +1 | 2:1.22.2-1.amzn2023.0.4 | ALAS2023-2026-3450 |
| Amazon Linux 2 | amazon-ssm-agent | 3.3.5828.0-1.amzn2 | ALAS2-2026-4101 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | gh +27 | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | caddy | 2.11.7-r7 | — |
| Wolfi rolling | cert-manager-1.20 +5 | 1.20.5-r0 | — |
| Wolfi rolling | cilium-1.19 +4 | 1.19.10-r1 | — |
| Wolfi rolling | cilium-cli | 0.20.1-r5 | — |
| Wolfi rolling | containerd-2.3 +2 | 2.3.7-r4 | — |
| Wolfi rolling | crossplane-provider-aws-cloudformation | 2.9.0-r5 | — |
| Wolfi rolling | crossplane-provider-aws-eks +5 | 2.9.0-r7 | — |
| Wolfi rolling | crossplane-provider-aws-s3 +8 | 2.9.0-r6 | — |
| Wolfi rolling | crossplane-provider-aws-sns +2 | 2.9.0-r8 | — |
| Wolfi rolling | crossplane-provider-azure-sql +4 | 2.8.0-r6 | — |
| Wolfi rolling | crossplane-provider-keycloak | 3.2.3-r4 | — |
| Wolfi rolling | ctr-1 +3 | 1.7.36-r9 | — |
| Wolfi rolling | ctr-2 +2 | 2.4.2-r4 | — |
| Wolfi rolling | ctr-2.4 +3 | 2.4.2-r5 | — |
| Wolfi rolling | dogstatsd-7.80 | 7.80.4-r26 | — |
| Wolfi rolling | external-dns-0.21 | 0.21.0-r31 | — |
| Wolfi rolling | falco-no-driver | 0.45.1-r2 | — |
| Wolfi rolling | flux-2.10 | 2.10.0-r1 | — |
| Wolfi rolling | flux-2.7 | 2.7.5-r47 | — |
| Wolfi rolling | flux-2.8 | 2.8.8-r30 | — |
| Wolfi rolling | flux-2.9 | 2.9.6-r5 | — |
| Wolfi rolling | fq | 0.18.0-r6 | — |
| Wolfi rolling | fuse-overlayfs-snapshotter | 2.1.7-r33 | — |
| Wolfi rolling | gitea | 28.2.0-r3 | — |
| Wolfi rolling | gitness | 3.3.0-r48 | — |
| Wolfi rolling | glab | 1.125.0-r1 | — |
| Wolfi rolling | grafana-pyroscope-2.0 | 2.0.6-r14 | — |
| Wolfi rolling | helm-3 | 3.22.1-r2 | — |
| Wolfi rolling | hubble | 1.20.2-r2 | — |
| Wolfi rolling | hugo +1 | 0.169.0-r1 | — |
| Wolfi rolling | hydra | 26.2.0-r34 | — |
| Wolfi rolling | k3d | 5.9.0-r19 | — |
| Wolfi rolling | k3s-1.32 +13 | No fix yet | — |
| Wolfi rolling | k3s-1.34 +1 | 1.34.12.1-r7 | — |
| Wolfi rolling | k3s-1.36 +1 | 1.36.5.1-r6 | — |
| Wolfi rolling | k3s-1.37 +1 | 1.37.1.1-r5 | — |
| Wolfi rolling | k3s-static-1.35 | 1.35.9.1-r7 | — |
| Wolfi rolling | k6 | 2.3.0-r6 | — |
| Wolfi rolling | kaf | 0.2.14-r20 | — |
| Wolfi rolling | kine | 0.17.3-r1 | — |
| Wolfi rolling | kots | 1.134.1-r1 | — |
| Wolfi rolling | kubeadm-1.34 +9 | 1.34.13-r2 | — |
| Wolfi rolling | kubeadm-1.35 +7 | 1.35.10-r1 | — |
| Wolfi rolling | kubeadm-1.36 +4 | 1.36.6-r0 | — |
| Wolfi rolling | kubeadm-1.37 +7 | 1.37.2-r1 | — |
| Wolfi rolling | kubectl-1.33 | 1.33.13-r16 | — |
| Wolfi rolling | kubernetes-1.36 +2 | 1.36.5-r5 | — |
| Wolfi rolling | kyverno-1.17 +5 | 1.17.2-r44 | — |
| Wolfi rolling | kyverno-cli-1.18 +1 | 1.18.2-r22 | — |
| Wolfi rolling | loki-3.6-loki-canary | 3.6.19-r1 | — |
| Wolfi rolling | loki-3.7 +2 | 3.7.9-r1 | — |
| Wolfi rolling | mailpit | 1.33.0-r0 | — |
| Wolfi rolling | minio | 0.20261023.200651-r2 | — |
| Wolfi rolling | mps-control-daemon +2 | 0.20.1-r6 | — |
| Wolfi rolling | nerdctl | 2.4.1-r6 | — |
| Wolfi rolling | nuclei | 3.11.1-r16 | — |
| Wolfi rolling | opentelemetry-collector | 0.164.0-r1 | — |
| Wolfi rolling | prometheus-operator +2 | 0.94.2-r1 | — |
| Wolfi rolling | rclone | 1.75.2-r4 | — |
| Wolfi rolling | runc | 1.5.2-r6 | — |
| Wolfi rolling | runc-1.4 | 1.4.3-r13 | — |
| Wolfi rolling | snyk-cli | 1.1308.3-r2 | — |
| Wolfi rolling | spire-agent +2 | 1.15.5-r2 | — |
| Wolfi rolling | src | 8.0.0-r6 | — |
| Wolfi rolling | step | 0.31.0-r8 | — |
| Wolfi rolling | step-ca | 0.30.2-r30 | — |
| Wolfi rolling | step-issuer | 0.12.0-r21 | — |
| Wolfi rolling | telegraf-1.38 | 1.38.4-r37 | — |
| Wolfi rolling | terraform-provider-acme | 3.2.1-r4 | — |
| Wolfi rolling | traefik-3.6 | 3.6.25-r15 | — |
| Wolfi rolling | traefik-3.7 | 3.7.16-r3 | — |
| Wolfi rolling | trufflehog | 3.99.7-r2 | — |
| Wolfi rolling | vale | 3.26.0-r0 | — |
| Wolfi rolling | wuzz | 0.5.0-r37 | — |
| Wolfi rolling | zot | 2.1.22-r8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | golang.org/x/net | < 0.62.0 | 0.62.0 | GO-2026-6860 |
Advisories 7
- ALAS2023-2026-3428 Moderate: amazon-ssm-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2023-2026-3450 Important: skopeo security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2023-2026-3451 Important: buildah security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2-2026-4101 Moderate: amazon-ssm-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2023-2026-3391 Important: docker security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- openSUSE-SU-2026:12430-1 google-osconfig-agent-20261103.02-1.1 on GA media SUSE / openSUSE Security Updates · Nov 6, 2026
- openSUSE-SU-2026:12425-1 amazon-cloudwatch-agent-1.300074.0-1.1 on GA media SUSE / openSUSE Security Updates · Nov 6, 2026