未評価

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing...

CVE-2026-78661 SecPulse初出 6:38

影響パッケージ

種類	パッケージ	影響を受ける版	直った版
golang.org/x/net	golang.org/x/net/html	0.62.0 未満	0.62.0
Go	golang.org/x/net	0.62.0 未満	0.62.0

原文の説明取得元が公開している説明をそのまま載せています (多くは英語)。

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

参照URL

web go.dev
web go.dev
web groups.google.com
web pkg.go.dev
web nvd.nist.gov
web github.com