← Vulnerability feed

Vulnerability record · CVE-2026-25680 · published 22 May 2026

CVE-2026-25680: Golang net uncontrolled resource consumption vulnerability

Golang · Net

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

6.5 CVSS 3.1 Medium EPSS 0.46% · top 62.7% CWE-400 · Uncontrolled resource consumption
6.5CVSS 3.1 base score
0.46%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
23 Jul 2026Last modified by NVD

Description

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://go.dev/cl/781702 Issue Tracking
https://go.dev/issue/79573 Issue Tracking
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 Mailing List
https://pkg.go.dev/vuln/GO-2026-5028 Vendor Advisory

Track CVE-2026-25680 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.6CVE-2026-39821Golang net vulnerabilityThe ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--exampl…EPSS 0.69%7.5CVE-2018-17846Golang net vulnerabilityThe html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during a…EPSS 2.5%7.5CVE-2018-17847Golang net memory buffer overflow vulnerabilityThe html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (…EPSS 2.4%7.5CVE-2018-17848Golang net vulnerabilityThe html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index …EPSS 2.2%7.5CVE-2018-17142Golang net null pointer dereference vulnerabilityThe html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCur…EPSS 2.4%7.5CVE-2018-17143Golang net memory buffer overflow vulnerabilityThe html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inB…EPSS 2.8%7.5CVE-2018-17075Golang net null pointer dereference vulnerabilityThe html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse…EPSS 2.8%6.1CVE-2026-27136Golang net clickjacking vulnerabilityParsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in app…EPSS 0.22%

Source: NIST National Vulnerability Database (record CVE-2026-25680), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.