Log in Start free

Vulnerability · Published Oct 27, 2026 · Assigned by Go

CVE-2026-78661Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

High 7.5

In plain English

A high-severity security flaw in golang.org/x/net/html from golang.org/x/net. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 64.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-golang-x-netno fix listedDEBIAN-CVE-2026-78661
Debian:13golang-golang-x-netno fix listedDEBIAN-CVE-2026-78661
Debian:14golang-golang-x-net1:0.62.0-1DEBIAN-CVE-2026-78661
Gogolang.org/x/net0.62.0GO-2026-6860
Ubuntu:22.04:LTSadsysno fix listedUBUNTU-CVE-2026-78661
Ubuntu:24.04:LTSadsysno fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.04:LTSadsysno fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.10adsysno fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTScontainerdno fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.10containerdno fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgolang-1.17no fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgolang-1.18no fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgolang-1.20no fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-78661
Ubuntu:24.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgolang-1.22no fix listedUBUNTU-CVE-2026-78661
Ubuntu:24.04:LTSgolang-1.22no fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-78661
Ubuntu:24.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-78661
Ubuntu:24.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-78661
Ubuntu:24.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-78661
Ubuntu:24.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.04:LTSgolang-1.26no fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.10golang-1.26no fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.10golang-1.27no fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgolang-golang-x-netno fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.04:LTSgolang-golang-x-netno fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.10golang-golang-x-netno fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-78661
Ubuntu:24.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.10google-guest-agentno fix listedUBUNTU-CVE-2026-78661
Ubuntu:22.04:LTSgoogle-osconfig-agentno fix listedUBUNTU-CVE-2026-78661
Ubuntu:24.04:LTSgoogle-osconfig-agentno fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.04:LTSgoogle-osconfig-agentno fix listedUBUNTU-CVE-2026-78661
Ubuntu:26.10google-osconfig-agentno fix listedUBUNTU-CVE-2026-78661

Affected products (as reported)

VendorProductVersions
golang.org/x/net golang.org/x/net/html 0 – before 0.62.0

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References